Hamlit improperly escapes quotes in attributes

Given the following Haml template:

!!!
%html
  %head
    %meta{content: "text/html; charset=UTF-8", "http-equiv" => "Content-Type"}/
    %meta{property: 'og:title',       content: unsafe_string(quote: '"')}
    %meta{property: 'og:description', content: unsafe_string(quote: "'")}
    %meta{property: 'og:description', content: double_quotes}

    %title TestHaml
    = stylesheet_link_tag    'application', media: 'all', 'data-turbolinks-track' => true
    = javascript_include_tag 'application', 'data-turbolinks-track' => true
    = csrf_meta_tags
  %body
    = yield

and the following helpers:

module ApplicationHelper
  def unsafe_string(quote: '"')
    %{0;url=http://www.bing.com#{quote} http-equiv=#{quote}refresh}.html_safe
  end

  def double_quotes
    %{0;url=http://www.bing.com" http-equiv='refresh'}.html_safe
  end
end

Haml 4.0.7 will produce the following HTML:

    <meta content='0;url=http://www.bing.com" http-equiv="refresh' property='og:title'>
    <meta content="0;url=http://www.bing.com' http-equiv='refresh" property='og:description'>
    <meta content='0;url=http://www.bing.com" http-equiv=&#x0027;refresh&#x0027;' property='og:description'>

while Hamlit 2.5.0 produces the following:

<meta content='0;url=http://www.bing.com" http-equiv="refresh' property='og:title'>
<meta content='0;url=http://www.bing.com' http-equiv='refresh' property='og:description'>
<meta content='0;url=http://www.bing.com" http-equiv='refresh'' property='og:description'>

this leads to XSS.

@DouweM Brings up the question, "What if it's not html_safe?". In that case, Hamlit does the correct thing and escapes the string. But if it's a drop-in replacement for Haml, it should be as paranoid as Haml is.

mentioned in issue #21017 (closed)

Reassigned to @rspeicher

Milestone changed to %8.11

mentioned in commit 01fc7633

mentioned in merge request !5873 (merged)

Status changed to closed by merge request !5873 (merged)

mentioned in commit 0ff39331

mentioned in commit e26ce27d

mentioned in commit 8b21b00f

Made the issue visible

Mentioned in commit pfjason/gitlab-ce@0ff39331

Mentioned in commit pfjason/gitlab-ce@8b21b00f

mentioned in commit test-nick/gitlab-ce@6079142b

mentioned in commit test-nick/gitlab-ce@4abc3509

mentioned in commit test-nick/gitlab-ce@f96a9e46

mentioned in merge request !14785