Ticket #4719: 4719_4.patch

_source/core/htmlparser/basicwriter.js

@@ -60 +60 @@
                  */
                 attribute : function( attName, attValue )
                 {
-                        // Browsers don't always escape quote in attribute values. (#4683)
-                        if ( typeof attValue == 'string' )
-                                attValue = attValue.replace( /"/g, '"' );
+                        // Browsers don't always escape special character in attribute values. (#4683, #4719).
+                        if ( typeof attValue == 'string' ) {
+                                attValue = attValue.replace( /"/g, '&quot;' ).replace( /</g, '&lt;' ).replace( />/, '&gt;' ).replace( /'/, '&#039;' );
+                        }
 
                         this._.output.push( ' ', attName, '="', attValue, '"' );
                 },

_source/plugins/htmlwriter/plugin.js

@@ -175 +175 @@
                         if ( typeof attValue == 'string' )
                         {
                                 this.forceSimpleAmpersand && ( attValue = attValue.replace( /&/g, '&' ) );
-                                // Browsers don't always escape quote in attribute values. (#4683)
-                                attValue = attValue.replace( /"/g, '"' );
+                                // Browsers don't always escape special character in attribute values. (#4683, #4719).
+                                attValue = attValue.replace( /"/g, '&quot;' ).replace( /</g, '&lt;' ).replace( />/, '&gt;' ).replace( /'/, '&#039;' );
                         }
 
                         this._.output.push( ' ', attName, '="', attValue, '"' );