Hello @leizongmin
After introducing new option with support for single-quoted attribute value syntax (#287) I've encountered a gap when this option is enabled.
During lack of escaping of single quote char in attribute value, we can pass a code like this:
<img src="/url' onerror='alert(1)'" /> and the output is <img src='/url' onerror='alert(1)'' /> which of course is not a result we wanted to be.
I've created a PR (#290) which adds an additional escaping for single quote char.
Please take a look
Hello @leizongmin
After introducing new option with support for single-quoted attribute value syntax (#287) I've encountered a gap when this option is enabled.
During lack of escaping of single quote char in attribute value, we can pass a code like this:
<img src="/url' onerror='alert(1)'" />and the output is<img src='/url' onerror='alert(1)'' />which of course is not a result we wanted to be.I've created a PR (#290) which adds an additional escaping for single quote char.
Please take a look