fix: Escape certain characters for attribute values

Author: linkdotnet

CHANGELOG.md

@@ -9,6 +9,7 @@ All notable changes to **bUnit** will be documented in this file. The project ad
 ### Fixed
 
 -   Added support in `FakeNavigationManager` to handle umlauts.
+-   Fixed a bug where attribute values did not get escaped. Reported by [@brettwinters](https://github.com/brettwinters). Fixed by [@linkdotnet](https://github.com/linkdotnet).
 
 ## [1.13.5] - 2022-12-16
 

src/bunit.web/Rendering/Internal/Htmlizer.cs

@@ -6,6 +6,7 @@
 using System.Globalization;
 using System.Text;
 using System.Text.Encodings.Web;
+using System.Text.Unicode;
 using Bunit.Rendering;
 
 namespace Bunit;
@@ -270,7 +271,7 @@ private static int RenderAttributes(
 					result.Append(frame.AttributeName);
 					result.Append('=');
 					result.Append('"');
-					result.Append(value);
+					result.Append(Escape(value));
 					result.Append('"');
 					break;
 				default:
@@ -281,6 +282,11 @@ private static int RenderAttributes(
 		return position + maxElements;
 	}
 
+	private static string Escape(string value) =>
+		value
+			.Replace("&", "&", StringComparison.OrdinalIgnoreCase)
+			.Replace("\"", """, StringComparison.OrdinalIgnoreCase);
+
 	private sealed class HtmlRenderingContext
 	{
 		private readonly RenderTreeFrameDictionary frames;

tests/bunit.testassets/BlazorE2E/ComponentWithEscapableCharacters.razor

@@ -1,5 +1,8 @@
 <p style="@Escaped">@Escaped</p>
 
 @code {
-	private string Escaped => "url('')";
+
+	[Parameter]
+	public string Escaped { get; set; }
+
 }

tests/bunit.web.tests/BlazorE2E/ComponentRenderingTest.cs

@@ -691,11 +691,13 @@ public async Task CanHandleRemovedParentObjectsAsync()
 	}
 
 	[Fact]
-	public void EscapableCharactersDontGetEncoded()
+	public void SomeEscapableCharactersDontGetEncoded()
 	{
-		var cut = RenderComponent<ComponentWithEscapableCharacters>();
+		const string input = "url('\"&')";
+		var cut = RenderComponent<ComponentWithEscapableCharacters>(
+			p => p.Add(s => s.Escaped, input));
 
-		cut.Markup.ShouldBe("<p style=\"url('')\">url('')</p>");
+		cut.Markup.ShouldBe("<p style=\"url('&quot;&amp;')\">url('\"&')</p>");
 	}
 
 	[Fact]