Ampersand is not escaped in attribute value
Thanks for providing all the info and details, that was helpful. Thanks also for the PR.
Read full answer below βQuestion
GrapesJS version [x] I confirm to use the latest version of GrapesJS What browser are you using? Chrome v142.0.7392.0 (canary) Reproducible demo link https://jsfiddle.net/xce183nm/1/ Describe the bug How to reproduce the bug? Create an editor instance and load HTML code that contains character references in attribute value. Get HTML code. What is the expected behavior? Symbols in attribute value are escaped with character references. The title attribute value of the p element is parsed as < & >. What is the current behavior? Symbols in attribute value are not escaped. The title attribute...
Answers (2)
Thanks for providing all the info and details, that was helpful. Thanks also for the PR.
You've identified a critical bug in GrapesJS's HTML serialization process regarding attribute value escaping. The issue stems from the Component model's renderAttributes method, which directly inserts attribute values into the HTML string without proper HTML entity escaping. This leads to unescaped...
Related Questions and Answers
Continue research with similar issue discussions.
Issue #3939
Disabled drag and drop in preview
GrapesJS version[X] I confirm to use the latest version of GrapesJSWhat browser are you using? v95Reproducible demo link https://codesandbo...
Issue #6570
Parser ignores `parser.optionsHtml.keepEmptyTextNodes` option
GrapesJS version [x] I confirm to use the latest version of GrapesJS What browser are you using? Chrom v140.0.7307.0 (canary) Reproducible...
Issue #6032
Image Component allows upload and selection of video files via drag and drop
GrapesJS version [X] I confirm to use the latest version of GrapesJS What browser are you using? Chrome v126 Reproducible demo link https:/...
Issue #3779
Editor.getSelected().toHTML() encodes inline javascript
GrapesJS version[X] I confirm to use the latest version of GrapesJSWhat browser are you using? latest (chrome)Reproducible demo link https:...
Paid Plugins That Match This Issue
Curated by issue keywords and label relevance to help you ship faster.
Loading paid plugin recommendations...
Check the open-source GrapesJS plugins on GitHub or run a quick search in our free catalog.
Browse free plugins βPremium plugins ship with support, regular updates, and production-ready features β save days of integration work.
Browse premium plugins βRelated tutorials
In-depth guides on the same topic.
Tutorial
How to Build a Production GrapesJS Editor: The Complete Walkthrough of Brief, Preset, Plugins, and Services
A complete walkthrough of building a production GrapesJS editor: how to choose a preset, pick plugins, and scope setup services without burning a sprint.
Tutorial
Big Updates: TinyMCE 8 and Placeholder 2.0 for GrapesJS
In May we shipped major updates to two of our most popular GrapesJS plugins β TinyMCE Inline Text Editor and Placeholder.
Tutorial
Find the Right GrapesJS Plugin in Seconds: Smarter Discovery Is Live
We're shipping a set of discovery upgrades. New label filters, a proper compatibility switch for GrapesJS vs Studio, one-click and a smarter sort bar.
Browse Plugin Categories
Jump directly to plugin category pages on the marketplace.