rustdoc: HTML-escape link section and export name

Lastly, add regression tests and clean up existing tests.

Author: fmease

src/librustdoc/html/render/mod.rs

@@ -2936,13 +2936,13 @@ fn render_attributes_in_code(
             prefix,
             match attr {
                 hir::Attribute::Parsed(AttributeKind::LinkSection { name, .. }) => {
-                    Cow::Owned(format!("#[unsafe(link_section = \"{name}\")]"))
+                    Cow::Owned(format!("#[unsafe(link_section = \"{}\")]", Escape(name.as_str())))
                 }
                 hir::Attribute::Parsed(AttributeKind::NoMangle(..)) => {
                     Cow::Borrowed("#[unsafe(no_mangle)]")
                 }
                 hir::Attribute::Parsed(AttributeKind::ExportName { name, .. }) => {
-                    Cow::Owned(format!("#[unsafe(export_name = \"{name}\")]"))
+                    Cow::Owned(format!("#[unsafe(export_name = \"{}\")]", Escape(name.as_str())))
                 }
                 hir::Attribute::Parsed(AttributeKind::NonExhaustive(..)) => {
                     Cow::Borrowed("#[non_exhaustive]")

tests/rustdoc/attribute-rendering.rs

@@ -9,6 +9,11 @@ pub extern "C" fn f() {}
 #[unsafe(export_name = "bar")]
 pub extern "C" fn g() {}
 
+//@ has foo/fn.escape.html '//*[@class="code-attribute"]' \
+//                         '#[unsafe(export_name = "<script>alert()</script>")]'
+#[unsafe(export_name = "<script>alert()</script>")]
+pub extern "C" fn escape() {}
+
 //@ has foo/fn.example.html '//*[@class="code-attribute"]' '#[unsafe(link_section = ".text")]'
 #[unsafe(link_section = ".text")]
 pub extern "C" fn example() {}

tests/rustdoc/attributes.rs

@@ -1,7 +1,19 @@
+// Ensure that we render attributes on inlined cross-crate re-exported items.
+
 //@ aux-crate:attributes=attributes.rs
 //@ edition:2021
 #![crate_name = "user"]
 
-//@ has 'user/struct.NonExhaustive.html'
-//@ has - '//*[@class="rust item-decl"]//*[@class="code-attribute"]' '#[non_exhaustive]'
+//@ has 'user/fn.no_mangle.html' '//pre[@class="rust item-decl"]' '#[unsafe(no_mangle)]'
+pub use attributes::no_mangle;
+
+//@ has 'user/fn.link_section.html' '//pre[@class="rust item-decl"]' \
+//                                  '#[unsafe(link_section = ".here")]'
+pub use attributes::link_section;
+
+//@ has 'user/fn.export_name.html' '//pre[@class="rust item-decl"]' \
+//                                 '#[unsafe(export_name = "exonym")]'
+pub use attributes::export_name;
+
+//@ has 'user/struct.NonExhaustive.html' '//pre[@class="rust item-decl"]' '#[non_exhaustive]'
 pub use attributes::NonExhaustive;

tests/rustdoc/inline_cross/attributes.rs

@@ -1,2 +1,11 @@
+#[unsafe(no_mangle)]
+pub fn no_mangle() {}
+
+#[unsafe(link_section = ".here")]
+pub fn link_section() {}
+
+#[unsafe(export_name = "exonym")]
+pub fn export_name() {}
+
 #[non_exhaustive]
 pub struct NonExhaustive;