From 3880a23de9004748319bdf3ecced676d6e5b2ea0 Mon Sep 17 00:00:00 2001
From: John MacFarlane <jgm@berkeley.edu>
Date: Sun, 17 Mar 2019 18:08:57 -0700
Subject: Properly escape attributes in Markdown writer.

Closes #5369.
---
 src/Text/Pandoc/Writers/Markdown.hs | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

(limited to 'src/Text/Pandoc')

diff --git a/src/Text/Pandoc/Writers/Markdown.hs b/src/Text/Pandoc/Writers/Markdown.hs
index 1a651e57f..4964fbad0 100644
--- a/src/Text/Pandoc/Writers/Markdown.hs
+++ b/src/Text/Pandoc/Writers/Markdown.hs
@@ -306,17 +306,22 @@ attrsToMarkdown :: Attr -> Doc
 attrsToMarkdown attribs = braces $ hsep [attribId, attribClasses, attribKeys]
         where attribId = case attribs of
                                 ([],_,_) -> empty
-                                (i,_,_)  -> "#" <> text i
+                                (i,_,_)  -> "#" <> escAttr i
               attribClasses = case attribs of
                                 (_,[],_) -> empty
                                 (_,cs,_) -> hsep $
-                                            map (text . ('.':))
+                                            map (escAttr . ('.':))
                                             cs
               attribKeys = case attribs of
                                 (_,_,[]) -> empty
                                 (_,_,ks) -> hsep $
-                                            map (\(k,v) -> text k
-                                              <> "=\"" <> text v <> "\"") ks
+                                            map (\(k,v) -> escAttr k
+                                              <> "=\"" <>
+                                              escAttr v <> "\"") ks
+              escAttr          = mconcat . map escAttrChar
+              escAttrChar '"'  = text "\\\""
+              escAttrChar '\\' = text "\\\\"
+              escAttrChar c    = text [c]
 
 linkAttributes :: WriterOptions -> Attr -> Doc
 linkAttributes opts attr =
-- 
cgit v1.2.3