fix: escape <& characters in attribute values (#1)

* fix: escape <& characters in attribute values * fix: Move & replacement first, so it does not replace the other escaped values
bacebu4 · Aug 15, 2024 · 9c626aa · 9c626aa
1 parent 8b9aad6
commit 9c626aa
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/index.js b/index.js
@@ -2,11 +2,14 @@
 const path = require('path');
 
 function escapeAttribute(s = '') {
-  return s.replace(/"/g, '&quot;').replace(/\n/g, '');
+  return s.replace(/&/g, '&amp;')
+          .replace(/</g, '&lt;')
+          .replace(/"/g, '&quot;')
+          .replace(/\n/g, '');
 }
 
 function escapeContent(s = '') {
-  return s.replace(/</g, '&lt;').replace(/&/g, '&amp;');
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;');
 }
 
 function treeToXML(tree) {