Ticket #4719: 4719_5.patch

_source/core/htmlparser/basicwriter.js

@@ -60 +60 @@
                  */
                 attribute : function( attName, attValue )
                 {
-                        // Browsers don't always escape quote in attribute values. (#4683)
-                        if ( typeof attValue == 'string' )
-                                attValue = attValue.replace( /"/g, '"' );
+                        // Browsers don't always escape special character in attribute values. (#4683, #4719).
+                        if ( typeof attValue == 'string' ) {
+                                attValue = CKEDITOR.tools.htmlEncodeAttr( attValue );
+                        }
 
                         this._.output.push( ' ', attName, '="', attValue, '"' );
                 },

_source/core/tools.js

@@ -321 +321 @@
 
                         return this.htmlEncode( text );
                 },
+                
+                /**
+                 * Replace special HTML characters in a string with their relative HTML
+                 * entity values.
+                 * @param {String} text The string to be encoded.
+                 * @returns {String} The encode string.
+                 * @example
+                 * alert( CKEDITOR.tools.htmlEncode( 'A > " < D' ) );  // "A &gt; &quote; &lt; D"
+                 */
+                
+                htmlEncodeAttr : function( text )
+                {
+                        return text.replace( /"/g, '&quot;' ).replace( /</g, '&lt;' ).replace( />/, '&gt;' );
+                },
 
                 /**
                  * Replace characters can't be represented through CSS Selectors string

_source/plugins/htmlwriter/plugin.js

@@ -175 +175 @@
                         if ( typeof attValue == 'string' )
                         {
                                 this.forceSimpleAmpersand && ( attValue = attValue.replace( /&/g, '&' ) );
-                                // Browsers don't always escape quote in attribute values. (#4683)
-                                attValue = attValue.replace( /"/g, '"' );
+                                // Browsers don't always escape special character in attribute values. (#4683, #4719).
+                                attValue = CKEDITOR.tools.htmlEncodeAttr( attValue );
                         }
 
                         this._.output.push( ' ', attName, '="', attValue, '"' );