diff --git a/psalm.xml b/psalm.xml index 4f01c49..b261ca6 100644 --- a/psalm.xml +++ b/psalm.xml @@ -33,6 +33,7 @@ + diff --git a/src/Html/Renderables/Text.php b/src/Html/Renderables/Text.php index c566d20..7c100f7 100644 --- a/src/Html/Renderables/Text.php +++ b/src/Html/Renderables/Text.php @@ -29,6 +29,6 @@ final class Text implements Renderable /** @return string */ public function getHtml() { - return Escaper::htmlElementValue($this->text); + return Escaper::htmlElementValueEscapingDoubleQuotes($this->text); } } diff --git a/src/Html/Sanitisation/Escaper.php b/src/Html/Sanitisation/Escaper.php index be975d4..858fabb 100644 --- a/src/Html/Sanitisation/Escaper.php +++ b/src/Html/Sanitisation/Escaper.php @@ -22,6 +22,15 @@ final class Escaper return self::escape($text, true); } + /** + * @param string $text + * @return string + */ + public static function htmlElementValueEscapingDoubleQuotes($text) + { + return \htmlspecialchars($text, \ENT_COMPAT, 'UTF-8'); + } + /** * @param string $text * @param bool $allowQuotes diff --git a/tests/ParsedownTest.php b/tests/ParsedownTest.php index 495de0a..96aa4ba 100755 --- a/tests/ParsedownTest.php +++ b/tests/ParsedownTest.php @@ -124,12 +124,12 @@ MARKDOWN_WITH_MARKUP;

<div>content</div>

sparse:

<div> -<div class="inner"> +<div class="inner"> content </div> </div>

paragraph

-

<style type="text/css"> +

<style type="text/css"> p { color: red; } diff --git a/tests/data/fenced_code_block.html b/tests/data/fenced_code_block.html index 50d39df..2c0eeb2 100644 --- a/tests/data/fenced_code_block.html +++ b/tests/data/fenced_code_block.html @@ -6,9 +6,9 @@ echo $message;

echo 'language identifier';
echo 'language identifier with non words';
<?php
-echo "Hello World";
+echo "Hello World";
 ?>
-<a href="http://auraphp.com" >Aura Project</a>
+<a href="http://auraphp.com" >Aura Project</a>
the following isn't quite enough to close
 ```
 still a fenced code block
diff --git a/tests/data/tab-indented_code_block.html b/tests/data/tab-indented_code_block.html index 7c140de..0ea64e6 100644 --- a/tests/data/tab-indented_code_block.html +++ b/tests/data/tab-indented_code_block.html @@ -3,4 +3,4 @@ $message = 'Hello World!'; echo $message; -echo "following a blank line"; \ No newline at end of file +echo "following a blank line"; \ No newline at end of file