HTML attribute values are double escaped in markdown #9017

New Issue

GiteaMirror · 2025-11-02T08:26:08-06:00

GiteaMirror commented

2025-11-02 08:26:08 -06:00

Originally created by @jtran on GitHub (May 31, 2022).

Description

I expect to be able to use the double-quote character, for example, in HTML attributes by escaping it using an entity reference. However, the sanitizer double escapes entity references.

For example:

<p title="Should have double quotes: &quot;hello&quot;">See tooltip/title of this.</p>

I expect to see double-quotes in the tooltip. Instead, I see ".

I reported this on the bluemonday repo, but I see no activity there, so I figured I'd bring it up here so that everyone is aware.

Relevant bluemonday issue: https://github.com/microcosm-cc/bluemonday/issues/143
Reproduced here: https://try.gitea.io/developers/foobar/pulls/1#issuecomment-116871

Gitea Version

1.16.8

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Docker, but also try.gitea.io.

Database

PostgreSQL

Originally created by @jtran on GitHub (May 31, 2022). ### Description I expect to be able to use the double-quote character, for example, in HTML attributes by escaping it using an entity reference. However, the sanitizer double escapes entity references. For example: ```html <p title="Should have double quotes: "hello"">See tooltip/title of this.</p> ``` I expect to see double-quotes in the tooltip. Instead, I see `"`. I reported this on the bluemonday repo, but I see no activity there, so I figured I'd bring it up here so that everyone is aware. Relevant bluemonday issue: https://github.com/microcosm-cc/bluemonday/issues/143 Reproduced here: https://try.gitea.io/developers/foobar/pulls/1#issuecomment-116871 ### Gitea Version 1.16.8 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Docker, but also try.gitea.io. ### Database PostgreSQL

GiteaMirror added the type/bug label 2025-11-02 08:26:08 -06:00

GiteaMirror closed this issue

2025-11-02 08:26:09 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9017