From ca14a079cbdf57be256a2b17c7821bd4caae97eb Mon Sep 17 00:00:00 2001
From: mohammed adib <adib@bugqore.com>
Date: Sat, 18 Jul 2026 11:40:29 +0530
Subject: [PATCH] escape attribute values and text content in getHtml

---
 src/core/dom/get-html.js            |  5 +++--
 test/unit/core/dom/test-get-html.js | 17 +++++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/src/core/dom/get-html.js b/src/core/dom/get-html.js
index 6edf041d6ce4..b40204972135 100644
--- a/src/core/dom/get-html.js
+++ b/src/core/dom/get-html.js
@@ -1,3 +1,4 @@
+import {escapeHtml} from '#core/dom';
 import {isElement, isString} from '#core/types';
 
 /** @type {Array<string>} */
@@ -70,7 +71,7 @@ function appendToResult(rootNode, attrs, result) {
     if (isString(node)) {
       result.push(node);
     } else if (node.nodeType === Node.TEXT_NODE) {
-      result.push(node.textContent ?? '');
+      result.push(escapeHtml(node.textContent ?? ''));
     } else if (isElement(node) && isApplicableNode(node)) {
       appendOpenTag(node, allowedAttrs, result);
       stack.push(`</${node.tagName.toLowerCase()}>`);
@@ -108,7 +109,7 @@ function appendOpenTag(node, attrs, result) {
 
   attrs.forEach((attr) => {
     if (node.hasAttribute(attr)) {
-      result.push(` ${attr}="${node.getAttribute(attr)}"`);
+      result.push(` ${attr}="${escapeHtml(node.getAttribute(attr))}"`);
     }
   });
 
diff --git a/test/unit/core/dom/test-get-html.js b/test/unit/core/dom/test-get-html.js
index 0e0ef311837f..a9421e742214 100644
--- a/test/unit/core/dom/test-get-html.js
+++ b/test/unit/core/dom/test-get-html.js
@@ -53,4 +53,21 @@ describes.sandboxed('DOM - getHtml', {}, () => {
     const result = getHtml(window, '.no-such-class', ['class', 'id']);
     expect(result).to.equal('');
   });
+
+  it('should escape quotes in attribute values', () => {
+    element.innerHTML =
+      '<div id="wrapper">' +
+      '<a class="c" title="x&quot; onmouseover=&quot;evil()">t</a>' +
+      '</div>';
+    const result = getHtml(window, '#wrapper', ['class', 'title']);
+    expect(result).to.not.include('onmouseover="evil()"');
+    expect(result).to.include('title="x&quot; onmouseover=&quot;evil()"');
+  });
+
+  it('should escape markup in text content', () => {
+    element.innerHTML =
+      '<div id="wrapper">&lt;img src=x onerror=alert(1)&gt;</div>';
+    const result = getHtml(window, '#wrapper', []);
+    expect(result).to.equal('<div>&lt;img src=x onerror=alert(1)&gt;</div>');
+  });
 });