From 4980d929b11022897bf2674ddb44548cb36a936c Mon Sep 17 00:00:00 2001
From: "Javi H. Gil" <javihgil@softspring.es>
Date: Wed, 8 Jul 2026 09:03:21 +0200
Subject: [PATCH] Escape image attributes

---
 src/Render/MediaRenderer.php            | 2 +-
 tests/Unit/Render/MediaRendererTest.php | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/Render/MediaRenderer.php b/src/Render/MediaRenderer.php
index 855b859..0e0071d 100644
--- a/src/Render/MediaRenderer.php
+++ b/src/Render/MediaRenderer.php
@@ -179,7 +179,7 @@ protected function getMedia(MediaInterface|string|null $media): ?MediaInterface
     protected function htmlAttributes(array $attributes): string
     {
         array_walk($attributes, function (&$value, $attribute) {
-            $value = "$attribute=\"$value\"";
+            $value = sprintf('%s="%s"', $attribute, htmlspecialchars((string) $value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8'));
         });
 
         return implode(' ', $attributes);
diff --git a/tests/Unit/Render/MediaRendererTest.php b/tests/Unit/Render/MediaRendererTest.php
index e3e3793..0eb39fa 100644
--- a/tests/Unit/Render/MediaRendererTest.php
+++ b/tests/Unit/Render/MediaRendererTest.php
@@ -68,6 +68,11 @@ public function testRenderImages()
         $expectedXlImg = '<img width="1800" height="1600" class="img-fluid" src="https://example.com/image.xl.jpeg" alt="" />';
         $this->assertEquals($expectedXlImg, $renderer->renderImage($media, 'xl', ['class' => 'img-fluid']));
 
+        $media->setDescription('A "quoted" image & <tag>');
+        $expectedXlImg = '<img width="1800" height="1600" class="img-fluid" src="https://example.com/image.xl.jpeg" alt="A &quot;quoted&quot; image &amp; &lt;tag&gt;" />';
+        $this->assertEquals($expectedXlImg, $renderer->renderImage($media, 'xl', ['class' => 'img-fluid']));
+        $media->setDescription(null);
+
         $versionL = new MediaVersion('l', $media);
         $versionL->setUrl('https://example.com/image.l.jpeg');
         $versionL->setWidth(800);