From 9d2d4de078d4b62740facdc1e5154679694671c1 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Jean-Christophe=20Beaupr=C3=A9?=
 <jcbrinfo@users.noreply.github.com>
Date: Thu, 4 Dec 2014 12:08:08 -0500
Subject: [PATCH] nitdoc: Escape attributes.
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jean-Christophe Beaupré <jcbrinfo@users.noreply.github.com>
---
 src/doc/doc_templates.nit |   15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/doc/doc_templates.nit b/src/doc/doc_templates.nit
index c4729a5..353ecdf 100644
--- a/src/doc/doc_templates.nit
+++ b/src/doc/doc_templates.nit
@@ -841,6 +841,16 @@ end
 
 # A HTML tag attribute
 #  `<tag attr="value">`
+#
+# ~~~nit
+# var attr: TagAttribute
+#
+# attr = new TagAttribute("foo", null)
+# assert attr.write_to_string == " foo=\"\""
+#
+# attr = new TagAttribute("foo", "bar<>")
+# assert attr.write_to_string == " foo=\"bar&lt;&gt;\""
+# ~~~
 class TagAttribute
 	super Template
 
@@ -850,9 +860,10 @@ class TagAttribute
 	redef fun rendering do
 		var value = self.value
 		if value == null then
-			add(" {name}")
+			# SEE: http://www.w3.org/TR/html5/infrastructure.html#boolean-attributes
+			add " {name.html_escape}=\"\""
 		else
-			add(" {name}=\"{value}\"")
+			add " {name.html_escape}=\"{value.html_escape}\""
 		end
 	end
 end
-- 
1.7.9.5