escaped attribute values in XML serialization.

1 files changed, 29 insertions, 28 deletions

diff --git a/src/core/XML.cpp b/src/core/XML.cpp
index 9c23e3b..528e1cd 100644
--- a/src/core/XML.cpp
+++ b/src/core/XML.cpp
@@ -36,6 +36,33 @@ void Node::serialize(std::ostream &out, const std::string &doctype, bool pretty)
 	doSerialize(out, 0, pretty);
 }
 
+static std::string escapePredefinedEntities(const std::string &input)
+{
+	std::stringstream ss;
+	for (const char &c : input) {
+		switch (c) {
+			case '<':
+				ss << "&lt;";
+				break;
+			case '>':
+				ss << "&gt;";
+				break;
+			case '&':
+				ss << "&amp;";
+				break;
+			case '\'':
+				ss << "&apos;";
+				break;
+			case '\"':
+				ss << "&quot;";
+				break;
+			default:
+				ss << c;
+		}
+	}
+	return std::move(ss.str());
+}
+
 void Element::doSerialize(std::ostream &out, unsigned int tabdepth, bool pretty)
 {
 	if (pretty) {
@@ -45,7 +72,8 @@ void Element::doSerialize(std::ostream &out, unsigned int tabdepth, bool pretty)
 	}
 	out << '<' << name;
 	for (auto &a : attributes) {
-		out << ' ' << a.first << "=\"" << a.second << '\"';
+		out << ' ' << a.first << "=\"" << escapePredefinedEntities(a.second)
+		    << '\"';
 	}
 	// if we have no children, we close the tag immediately.
 	if (children.size() == 0) {
@@ -73,33 +101,6 @@ void Element::doSerialize(std::ostream &out, unsigned int tabdepth, bool pretty)
 	}
 }
 
-static std::string escapePredefinedEntities(const std::string &input)
-{
-	std::stringstream ss;
-	for (const char &c : input) {
-		switch (c) {
-			case '<':
-				ss << "&lt;";
-				break;
-			case '>':
-				ss << "&gt;";
-				break;
-			case '&':
-				ss << "&amp;";
-				break;
-			case '\'':
-				ss << "&apos;";
-				break;
-			case '\"':
-				ss << "&quot;";
-				break;
-			default:
-				ss << c;
-		}
-	}
-	return std::move(ss.str());
-}
-
 void Text::doSerialize(std::ostream &out, unsigned int tabdepth, bool pretty)
 {
 	if (pretty) {