XML/HTML entities in attributes will no longer be preserved when rend…

…ering (#353)

This applies the previous commit's XSS fix to all custom attributes

CHANGELOG.md

@@ -4,6 +4,10 @@ Updates should follow the [Keep a CHANGELOG](http://keepachangelog.com/) princip
 
 ## [Unreleased][unreleased]
 
+### Changed
+
+ - XML/HTML entities in attributes will no longer be preserved when rendering (#353)
+
 ### Fixed
 
  - Fix XSS vulnerability caused by improper preservation of entities when rendering (#353)

src/Block/Renderer/BlockQuoteRenderer.php

@@ -37,7 +37,7 @@ public function render(AbstractBlock $block, ElementRendererInterface $htmlRende
 
         $attrs = [];
         foreach ($block->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         $filling = $htmlRenderer->renderBlocks($block->children());

src/Block/Renderer/FencedCodeRenderer.php

@@ -37,7 +37,7 @@ public function render(AbstractBlock $block, ElementRendererInterface $htmlRende
 
         $attrs = [];
         foreach ($block->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         $infoWords = $block->getInfoWords();

src/Block/Renderer/HeadingRenderer.php

@@ -39,7 +39,7 @@ public function render(AbstractBlock $block, ElementRendererInterface $htmlRende
 
         $attrs = [];
         foreach ($block->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         return new HtmlElement($tag, $attrs, $htmlRenderer->renderInlines($block->children()));

src/Block/Renderer/IndentedCodeRenderer.php

@@ -37,7 +37,7 @@ public function render(AbstractBlock $block, ElementRendererInterface $htmlRende
 
         $attrs = [];
         foreach ($block->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         return new HtmlElement(

src/Block/Renderer/ListBlockRenderer.php

@@ -41,7 +41,7 @@ public function render(AbstractBlock $block, ElementRendererInterface $htmlRende
 
         $attrs = [];
         foreach ($block->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         if ($listData->start !== null && $listData->start !== 1) {

src/Block/Renderer/ListItemRenderer.php

@@ -45,7 +45,7 @@ public function render(AbstractBlock $block, ElementRendererInterface $htmlRende
 
         $attrs = [];
         foreach ($block->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         $li = new HtmlElement('li', $attrs, $contents);

src/Block/Renderer/ParagraphRenderer.php

@@ -41,7 +41,7 @@ public function render(AbstractBlock $block, ElementRendererInterface $htmlRende
 
         $attrs = [];
         foreach ($block->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         return new HtmlElement('p', $attrs, $htmlRenderer->renderInlines($block->children()));

src/Block/Renderer/ThematicBreakRenderer.php

@@ -37,7 +37,7 @@ public function render(AbstractBlock $block, ElementRendererInterface $htmlRende
 
         $attrs = [];
         foreach ($block->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         return new HtmlElement('hr', $attrs, '', true);

src/Inline/Renderer/CodeRenderer.php

@@ -36,7 +36,7 @@ public function render(AbstractInline $inline, ElementRendererInterface $htmlRen
 
         $attrs = [];
         foreach ($inline->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         return new HtmlElement('code', $attrs, Xml::escape($inline->getContent()));

src/Inline/Renderer/EmphasisRenderer.php

@@ -36,7 +36,7 @@ public function render(AbstractInline $inline, ElementRendererInterface $htmlRen
 
         $attrs = [];
         foreach ($inline->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         return new HtmlElement('em', $attrs, $htmlRenderer->renderInlines($inline->children()));

src/Inline/Renderer/ImageRenderer.php

@@ -44,7 +44,7 @@ public function render(AbstractInline $inline, ElementRendererInterface $htmlRen
 
         $attrs = [];
         foreach ($inline->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         $forbidUnsafeLinks = $this->config->getConfig('safe') || !$this->config->getConfig('allow_unsafe_links');

src/Inline/Renderer/LinkRenderer.php

@@ -44,7 +44,7 @@ public function render(AbstractInline $inline, ElementRendererInterface $htmlRen
 
         $attrs = [];
         foreach ($inline->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         $forbidUnsafeLinks = $this->config->getConfig('safe') || !$this->config->getConfig('allow_unsafe_links');

src/Inline/Renderer/StrongRenderer.php

@@ -36,7 +36,7 @@ public function render(AbstractInline $inline, ElementRendererInterface $htmlRen
 
         $attrs = [];
         foreach ($inline->getData('attributes', []) as $key => $value) {
-            $attrs[$key] = Xml::escape($value, true);
+            $attrs[$key] = Xml::escape($value);
         }
 
         return new HtmlElement('strong', $attrs, $htmlRenderer->renderInlines($inline->children()));