This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 24174 - < should be quoted in attribute values
Summary: < should be quoted in attribute values
Status: RESOLVED FIXED
Alias: None
Product: WebAppsWG
Classification: Unclassified
Component: DOM Parsing and Serialization (show other bugs)
Version: unspecified
Hardware: PC All
: P2 normal
Target Milestone: ---
Assignee: Travis Leithead [MSFT]
QA Contact: public-webapps-bugzilla
URL:
Whiteboard:
Keywords:
: 24211 24795 (view as bug list)
Depends on:
Blocks: 24795
  Show dependency tree / graph
 
Reported: 2013-12-28 21:58 UTC by Victor Costan
Modified: 2014-10-13 23:45 UTC (History)
4 users (show)

See Also:

Attachments

Description Victor Costan 2013-12-28 21:58:53 UTC 
The XML specification forbids < in attribute values.

Source 1: see the grammar for AttValue below.
http://www.w3.org/TR/REC-xml/#sec-common-syn

Source 2: http://www.w3.org/TR/REC-xml/#CleanAttrVals


The XML serialization algorithm in the DOM Parsing and Serialization specification can produce < in XML attribute values.

https://dvcs.w3.org/hg/innerhtml/raw-file/tip/index.html#dfn-concept-serialize-xml-attributes

Specifically, step 2 substep 4 only quotes " and &. It should also quote < as &lt;.
Comment 1 Victor Costan 2014-01-04 19:29:33 UTC 
One more note -- all browsers currently quote both < (as ^&lt;) and > (as &gt;) in XML attributes.
Comment 2 Boris Zbarsky 2014-02-04 17:48:54 UTC 
How about we just spec the behavior that all browsers have, then?  Quoting '<' but not '>' makes for pretty bizarre behavior when things try to paren-match and whatnot, so while it's valid XML to leave the '>' as is, it's less confusing to just escape it.
Comment 3 Victor Costan 2014-02-04 21:54:26 UTC 
I completely agree with quoting both '<' and '>' in XML attributes.

It'd be nice if the spec included a non-normative reference to the XML grammar, so other poor confused souls will easily understand why '<' and '>' are unescaped in HMTL attrs, but escaped in XML attrs.
Comment 4 Travis Leithead [MSFT] 2014-02-25 01:14:07 UTC 
Sounds good. I've made this change to the XML attributes serializing section, including a note referencing XML.

https://dvcs.w3.org/hg/innerhtml/rev/bfa43ce953aa
Comment 5 Victor Costan 2014-02-25 08:38:45 UTC 
Thank you very much!
Comment 6 Travis Leithead [MSFT] 2014-10-13 23:44:29 UTC 
*** Bug 24795 has been marked as a duplicate of this bug. ***
Comment 7 Travis Leithead [MSFT] 2014-10-13 23:45:48 UTC 
*** Bug 24211 has been marked as a duplicate of this bug. ***