diff --git a/extension/ezoe/ezxmltext/handlers/input/ezoeinputparser.php b/extension/ezoe/ezxmltext/handlers/input/ezoeinputparser.php index 95b6fa0d6fb..d7957977021 100644 --- a/extension/ezoe/ezxmltext/handlers/input/ezoeinputparser.php +++ b/extension/ezoe/ezxmltext/handlers/input/ezoeinputparser.php @@ -262,7 +262,7 @@ function setAttributes( $element, $attributes ) if ( isset( $this->Namespaces[$prefix] ) ) { $URI = $this->Namespaces[$prefix]; - $element->setAttributeNS( $URI, $qualifiedName, $value ); + $element->setAttributeNS( $URI, $qualifiedName, htmlspecialchars_decode( $value ) ); } else { @@ -271,7 +271,7 @@ function setAttributes( $element, $attributes ) } else { - $element->setAttribute( $qualifiedName, $value ); + $element->setAttribute( $qualifiedName, htmlspecialchars_decode( $value ) ); } } } diff --git a/extension/ezoe/ezxmltext/handlers/input/ezoexmlinput.php b/extension/ezoe/ezxmltext/handlers/input/ezoexmlinput.php index d14883f5685..ede5119d8b8 100644 --- a/extension/ezoe/ezxmltext/handlers/input/ezoexmlinput.php +++ b/extension/ezoe/ezxmltext/handlers/input/ezoexmlinput.php @@ -1744,12 +1744,12 @@ public static function getCustomAttrPart( $tag, &$styleString ) if ( $customAttributePart === '' ) { $customAttributePart = ' customattributes="'; - $customAttributePart .= $attribute->name . '|' . $attribute->value; + $customAttributePart .= $attribute->name . '|' . htmlspecialchars( $attribute->value ); } else { $customAttributePart .= 'attribute_separation' . $attribute->name . '|' . - $attribute->value; + htmlspecialchars( $attribute->value ); } if ( isset( self::$customAttributeStyleMap[$attribute->name] ) ) { diff --git a/extension/ezoe/tests/ezoexmltext_regression.php b/extension/ezoe/tests/ezoexmltext_regression.php index 54538fa5d93..ed9ea84b452 100644 --- a/extension/ezoe/tests/ezoexmltext_regression.php +++ b/extension/ezoe/tests/ezoexmltext_regression.php @@ -34,16 +34,37 @@ public function providerParsingGreaterThanAttribute() array( '
This is a fact
This is a fact
Text between
This is a fact