[FIX] qweb: support attributes with quotes

closes #651

src/qweb/qweb.ts

@@ -174,6 +174,10 @@ function parseXML(xml: string): Document {
   return doc;
 }
 
+function escapeQuotes(str: string): string {
+  return str.replace(/\'/g, "\\'");
+}
+
 //------------------------------------------------------------------------------
 // QWeb rendering engine
 //------------------------------------------------------------------------------
@@ -694,13 +698,13 @@ export class QWeb extends EventBus {
           if ((value = value.trim())) {
             let classDef = value
               .split(/\s+/)
-              .map(a => `'${a}':true`)
+              .map(a => `'${escapeQuotes(a)}':true`)
               .join(",");
             classObj = `_${ctx.generateID()}`;
             ctx.addLine(`let ${classObj} = {${classDef}};`);
           }
         } else {
-          ctx.addLine(`let _${attID} = '${value}';`);
+          ctx.addLine(`let _${attID} = '${escapeQuotes(value)}';`);
           if (!name.match(/^[a-zA-Z]+$/)) {
             // attribute contains 'non letters' => we want to quote it
             name = '"' + name + '"';

tests/qweb/__snapshots__/qweb.test.ts.snap

@@ -923,6 +923,19 @@ exports[`static templates div with a class attribute 1`] = `
 }"
 `;
 
+exports[`static templates div with a class attribute with a quote 1`] = `
+"function anonymous(context, extra
+) {
+    // Template name: \\"test\\"
+    let h = this.h;
+    let _2 = {'a\\\\'bc':true};
+    let c3 = [], p3 = {key:3,class:_2};
+    let vn3 = h('div', p3, c3);
+    c3.push({text: \`word\`});
+    return vn3;
+}"
+`;
+
 exports[`static templates div with a empty class attribute 1`] = `
 "function anonymous(context, extra
 ) {
@@ -962,6 +975,19 @@ exports[`static templates div with a text node 1`] = `
 }"
 `;
 
+exports[`static templates div with an arbitrary attribute with a quote 1`] = `
+"function anonymous(context, extra
+) {
+    // Template name: \\"test\\"
+    let h = this.h;
+    let _1 = 'a\\\\'bc';
+    let c2 = [], p2 = {key:2,attrs:{abc: _1}};
+    let vn2 = h('div', p2, c2);
+    c2.push({text: \`word\`});
+    return vn2;
+}"
+`;
+
 exports[`static templates empty div 1`] = `
 "function anonymous(context, extra
 ) {

tests/qweb/qweb.test.ts

@@ -51,6 +51,16 @@ describe("static templates", () => {
     expect(renderToString(qweb, "test")).toBe(`<div class="abc">word</div>`);
   });
 
+  test("div with a class attribute with a quote", () => {
+    qweb.addTemplate("test", `<div class="a'bc">word</div>`);
+    expect(renderToString(qweb, "test")).toBe(`<div class="a'bc">word</div>`);
+  });
+
+  test("div with an arbitrary attribute with a quote", () => {
+    qweb.addTemplate("test", `<div abc="a'bc">word</div>`);
+    expect(renderToString(qweb, "test")).toBe(`<div abc="a'bc">word</div>`);
+  });
+
   test("div with a empty class attribute", () => {
     qweb.addTemplate("test", `<div class="">word</div>`);
     expect(renderToString(qweb, "test")).toBe(`<div>word</div>`);