Issue #6603Opened September 4, 2025by nanto1 reactions

BUG: Ampersand is not escaped in attribute value

Question

GrapesJS version

  • I confirm to use the latest version of GrapesJS

What browser are you using?

Chrome v142.0.7392.0 (canary)

Reproducible demo link

https://jsfiddle.net/xce183nm/1/

Describe the bug

How to reproduce the bug?

  1. Create an editor instance and load HTML code that contains character references in attribute value. 
    const editor = grapesjs.init({
  components: '<body><p title="&lt; &amp;amp; &gt;"></p></body>',
});
  2. Get HTML code. 
    const result = editor.getHtml();

What is the expected behavior?

Symbols in attribute value are escaped with character references. The title attribute value of the p element is parsed as < &amp; >.

<body><p title="&lt; &amp;amp; &gt;"></p></body>

What is the current behavior?

Symbols in attribute value are not escaped. The title attribute value of the p element is parsed as < & >.

<body><p title="< &amp; >"></p></body>

We have to escape ampersand to keep round-trip conversion between HTML parsing and serializing.

In addition, I think it is better to escape less-than and greater-than since:

  1. Latest browsers escape less-than and greater-than in attribute value (e.g. const p = document.createElement('p'); p.title = '< &amp; >'; p.outerHTML; outputs '<p title="&lt; &amp;amp; &gt;"></p>'), and
  2. There are many programs that process HTML code with rough regexp pattern like <[^>]+>. Escaping less-than and greater than improves interoperability with those programs.

Code of Conduct

  • I agree to follow this project's Code of Conduct

Answers (1)

artf• September 12, 20251 reactions

Thanks for providing all the info and details, that was helpful. Thanks also for the PR.

Related Questions and Answers

Continue research with similar issue discussions.

Issue #6116

BUG: asDocument not working as expected

GrapesJS version [X] I confirm to use the latest version of GrapesJS What browser are you using? Chrome 128 Reproducible demo link https://...

3 answersUpdated September 4, 2024

Issue #5020

BUG: Changing Title Attribute on Views Panel Buttons Doesn't Persist

GrapesJS version[X] I confirm to use the latest version of GrapesJSWhat browser are you using? ChromeReproducible demo link https://jsfiddl...

1 answersUpdated April 5, 2023

Issue #6570

BUG: parser ignores `parser.optionsHtml.keepEmptyTextNodes` option

GrapesJS version [x] I confirm to use the latest version of GrapesJS What browser are you using? Chrom v140.0.7307.0 (canary) Reproducible...

0 answersUpdated July 24, 2025

Issue #4148

BUG: 0.18.2 / 0.18.3 removes all on... HTML attributes when block is drag-dropped in the builder

GrapesJS version[X] I confirm to use the latest version of GrapesJSWhat browser are you using? Chrome v99Reproducible demo link https://jsf...

2 answersUpdated February 21, 2022

Paid Plugins That Match This Issue

Curated by issue keywords and label relevance to help you ship faster.

View all plugins

Loading paid plugin recommendations...

Browse Plugin Categories

Jump directly to plugin category pages on the marketplace.

PresetsPluginsComponentsBlocksAssetsCommandsI18nLayersStylesStoragesRTENewslettersWeb pagesSite builders