OutputXML should escape attribute values.

antchfx / xmlquery

xmlquery is Golang XPath package for XML query.

https://github.com/antchfx/xpath

MIT License

444 stars 89 forks source link

OutputXML should escape attribute values. #19

Closed thomas001 closed 5 years ago

thomas001 commented 5 years ago

It seems like OutputXML just writes the plain string when writing attribute values. It should probably call xml.EscapeText on it before writing. Quotes are most certainly disallowed in attributes, and some badly written parser might even hang when < or > are used.