Attribute values can contain slashes

src/Utils.cpp

@@ -433,6 +433,7 @@ utils::escapeBlacklistedHtml(const QString &rawStr)
       "details",    "/details",    "summary", "/summary"};
     constexpr static const std::array tagNameEnds   = {' ', '>'};
     constexpr static const std::array attrNameEnds  = {' ', '>', '=', '\t', '\r', '\n', '/', '\f'};
+    constexpr static const std::array attrValueEnds = {' ', '\t', '\r', '\n', '\f', '>'};
     constexpr static const std::array spaceChars    = {' ', '\t', '\r', '\n', '\f'};
 
     QByteArray data = rawStr.toUtf8();
@@ -535,16 +536,22 @@ utils::escapeBlacklistedHtml(const QString &rawStr)
                                         continue;
                                     }
                                 } else {
-                                    attrStart += 1;
                                     auto valueEnd = std::find_first_of(attrStart,
                                                                        attrsEnd,
-                                                                       attrNameEnds.begin(),
-                                                                       attrNameEnds.end());
+                                                                       attrValueEnds.begin(),
+                                                                       attrValueEnds.end());
+                                    auto val =
+                                      sanitizeValue(QByteArray(attrStart, valueEnd - attrStart));
+                                    attrStart = consumeSpaces(valueEnd);
+
+                                    if (val.contains('"'))
+                                        continue;
+
                                     buffer.append(' ');
                                     buffer.append(attrName);
-                                    buffer.append("=");
-                                    buffer.append(attrStart, valueEnd - attrStart);
-                                    attrStart = valueEnd;
+                                    buffer.append("=\"");
+                                    buffer.append(val);
+                                    buffer.append('"');
                                     continue;
                                 }
                             }