Use Sanitizer::encodeAttribute instead of raw htmlspecialchars for encoding attribute...

* Preserves tabs and newlines as given (they would otherwise be normalized to spaces by the XML input processor)
* When generating output back to wiki text, this avoids line-based block parsing breakage. (bug 6577)

diff --git a/includes/Xml.php b/includes/Xml.php
index 6e2518f..5299336 100644 (file)
--- a/includes/Xml.php
+++ b/includes/Xml.php
@@ -20,7 +20,7 @@ class Xml {
                $out = '<' . $element;\r
                if( !is_null( $attribs ) ) {\r
                        foreach( $attribs as $name => $val ) {\r
-                               $out .= ' ' . $name . '="' . htmlspecialchars( $val ) . '"';\r
+                               $out .= ' ' . $name . '="' . Sanitizer::encodeAttribute( $val ) . '"';\r
                        }\r
                }\r
                if( is_null( $contents ) ) {\r

diff --git a/maintenance/parserTests.txt b/maintenance/parserTests.txt
index 920f478..0238051 100644 (file)
--- a/maintenance/parserTests.txt
+++ b/maintenance/parserTests.txt
@@ -4448,6 +4448,15 @@ Fuzz testing: image with bogus manual thumbnail
 
 !!end
 
+!! test
+Fuzz testing: encoded newline in generated HTML replacements (bug 6577)
+!! input
+<pre dir="&#10;"></pre>
+!! result
+<pre dir="&#10;"></pre>
+
+!! end
+
 !! test
 Parsing optional HTML elements (Bug 6171)
 !! options