From 5f12464b2dbb64222b74c231e33366be19f8c13a Mon Sep 17 00:00:00 2001
From: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com>
Date: Wed, 19 Sep 2018 11:55:20 +0200
Subject: [PATCH] Wrap target attribute content in double quotes

---
 src/restricted_html.cpp       |    2 +-
 test/test_restricted_html.cpp |   14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/restricted_html.cpp b/src/restricted_html.cpp
index 28c1eed..76d75a7 100644
--- a/src/restricted_html.cpp
+++ b/src/restricted_html.cpp
@@ -65,7 +65,7 @@ const set<string> ALLOWED_TAGS = boost::assign::list_of("h1")("h2")("h3")("h4")
                                                        ("table");
 const string AHREF = "<a href=";
 const string REDIRECT_PREFIX = "/arnie?form=redirect&url=";
-const string TARGET_BLANK = "target=_blank";
+const string TARGET_BLANK = "target=\"_blank\"";
 const pcrecpp::RE SAFE_URL("^(http(s?):\\/\\/)(([a-zA-Z0-9\\.\\-\\_]+(\\.[a-zA-"
                            "Z]{2,3})+)|((?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-"
                            "9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"
diff --git a/test/test_restricted_html.cpp b/test/test_restricted_html.cpp
index 65f4dcd..36d86bb 100644
--- a/test/test_restricted_html.cpp
+++ b/test/test_restricted_html.cpp
@@ -46,7 +46,7 @@ BOOST_AUTO_TEST_CASE(BasicTest)
                              "Savings</th>  </tr>  <tr>    <td>January</td>   "
                              " <td>$100</td>  </tr></table> <p>Paragraph with "
                              "a  <a href=\"/arnie?form=redirect&url=https%3A%2"
-                             "F%2Fexample%2Ede\" target=_blank><i>Acceptable L"
+                             "F%2Fexample%2Ede\" target=\"_blank\"><i>Acceptable L"
                              "ink</i></a>.</p> <ul>  <li>Coffee</li>   <li>Tea"
                              "</li>  <li>Milk</li></ul>"), output);
 }
@@ -127,7 +127,7 @@ BOOST_AUTO_TEST_CASE(AhrefLink)
 {
     string output = restrict_html("<a href=\"http://i2n.de/\" >test</a>");
     BOOST_CHECK_EQUAL(string("<a href=\"/arnie?form=redirect&url=http%3A%2F%2Fi"
-                             "2n%2Ede%2F\" target=_blank>test</a>"), output);
+                             "2n%2Ede%2F\" target=\"_blank\">test</a>"), output);
 }
 
 BOOST_AUTO_TEST_CASE(AhrefLink2)
@@ -141,7 +141,7 @@ BOOST_AUTO_TEST_CASE(AhrefLink3)
 {
     string output = restrict_html("<a href=\"http://www.test.com/form\">test</a>");
     BOOST_CHECK_EQUAL(string("<a href=\"/arnie?form=redirect&url=http%3A%2F%2Fw"
-                             "ww%2Etest%2Ecom%2Fform\" target=_blank>test</a>"),
+                             "ww%2Etest%2Ecom%2Fform\" target=\"_blank\">test</a>"),
                       output);
 }
 
@@ -150,8 +150,8 @@ BOOST_AUTO_TEST_CASE(AhrefLinkIPAddress)
     string output = restrict_html("<a href=\"http://192.168.10.10:8080/form\">"
                                   "test</a>");
     BOOST_CHECK_EQUAL(string("<a href=\"/arnie?form=redirect&url=http%3A%2F%2F"
-                             "192%2E168%2E10%2E10%3A8080%2Fform\" target=_blan"
-                             "k>test</a>"), output);
+                             "192%2E168%2E10%2E10%3A8080%2Fform\" target="
+                             "\"_blank\">test</a>"), output);
 }
 
 BOOST_AUTO_TEST_CASE(AhrefLinkIPAddressNoPort)
@@ -164,7 +164,7 @@ BOOST_AUTO_TEST_CASE(AhrefProtocol)
 {
     string output = restrict_html("<a href=\"http://www.foo.com\">foo</a>");
     BOOST_CHECK_EQUAL(string("<a href=\"/arnie?form=redirect&url=http%3A%2F%2F"
-                             "www%2Efoo%2Ecom\" target=_blank>foo</a>"), output);
+                             "www%2Efoo%2Ecom\" target=\"_blank\">foo</a>"), output);
 }
 
 BOOST_AUTO_TEST_CASE(AhrefWrongProtocol)
@@ -204,7 +204,7 @@ BOOST_AUTO_TEST_CASE(EncodedURL)
     string output = restrict_html("<A HREF=\"http://%77%77%77%2E%67%6F%6F%67%6C"
                                   "%65%2E%63%6F%6D\">test</A>");
     BOOST_CHECK_EQUAL(string("<a href=\"/arnie?form=redirect&url=http%3A%2F%2Fw"
-                             "ww%2Egoogle%2Ecom\" target=_blank>test</a>"),
+                             "ww%2Egoogle%2Ecom\" target=\"_blank\">test</a>"),
                       output);
 }
 
-- 
1.7.1