From 8e6afff0a138e16439a1c41510bc0486b9375709 Mon Sep 17 00:00:00 2001
From: mrkishi <mauriciokishi@gmail.com>
Date: Wed, 2 Mar 2022 21:29:38 -0300
Subject: [PATCH 1/2] fix attribute escaping during ssr

---
 src/runtime/internal/ssr.ts                                   | 3 ++-
 .../samples/attribute-escaped-quotes/_expected.html           | 4 ++--
 .../samples/attribute-escaped-quotes/main.svelte              | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/runtime/internal/ssr.ts b/src/runtime/internal/ssr.ts
index aeaf6e8de8a..9588f806f93 100644
--- a/src/runtime/internal/ssr.ts
+++ b/src/runtime/internal/ssr.ts
@@ -177,7 +177,8 @@ export function create_ssr_component(fn) {
 
 export function add_attribute(name, value, boolean) {
 	if (value == null || (boolean && !value)) return '';
-	return ` ${name}${value === true && boolean_attributes.has(name) ? '' : `=${typeof value === 'string' ? JSON.stringify(escape(value)) : `"${value}"`}`}`;
+	const assignment = (boolean && value === true) ? '' : `="${escape_attribute_value(value.toString())}"`;
+	return ` ${name}${assignment}`;
 }
 
 export function add_classes(classes) {
diff --git a/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html b/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html
index c3c9405d7b1..0942b38e1b5 100644
--- a/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html
+++ b/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html
@@ -1,3 +1,3 @@
 <div
-	foo="&#34;></div><script>alert(42)</script>"
-></div>
\ No newline at end of file
+	foo="&#34;></div>\<script>alert(42)</script>"
+></div>
diff --git a/test/server-side-rendering/samples/attribute-escaped-quotes/main.svelte b/test/server-side-rendering/samples/attribute-escaped-quotes/main.svelte
index ed34f4d129c..4a6855878a1 100644
--- a/test/server-side-rendering/samples/attribute-escaped-quotes/main.svelte
+++ b/test/server-side-rendering/samples/attribute-escaped-quotes/main.svelte
@@ -1,5 +1,5 @@
 <script>
-	export let foo = '"></div><script>alert(42)</' + 'script>';
+	export let foo = '"></div>\\<script>alert(42)</' + 'script>';
 </script>
 
 <div foo={foo}></div>
\ No newline at end of file

From b221a6df587c36a56bfe616b51737682da166139 Mon Sep 17 00:00:00 2001
From: mrkishi <mauriciokishi@gmail.com>
Date: Wed, 2 Mar 2022 21:48:08 -0300
Subject: [PATCH 2/2] add test for object values in attributes

---
 .../samples/attribute-escaped-quotes/_expected.html            | 1 +
 .../samples/attribute-escaped-quotes/main.svelte               | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html b/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html
index 0942b38e1b5..e99c5b0f6ec 100644
--- a/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html
+++ b/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html
@@ -1,3 +1,4 @@
 <div
 	foo="&#34;></div>\<script>alert(42)</script>"
+	bar="&#34;></div>\<script>alert(42)</script>"
 ></div>
diff --git a/test/server-side-rendering/samples/attribute-escaped-quotes/main.svelte b/test/server-side-rendering/samples/attribute-escaped-quotes/main.svelte
index 4a6855878a1..aeed0f20d1a 100644
--- a/test/server-side-rendering/samples/attribute-escaped-quotes/main.svelte
+++ b/test/server-side-rendering/samples/attribute-escaped-quotes/main.svelte
@@ -1,5 +1,6 @@
 <script>
 	export let foo = '"></div>\\<script>alert(42)</' + 'script>';
+	export let bar = { toString: () => '"></div>\\<script>alert(42)<\/script>' };
 </script>
 
-<div foo={foo}></div>
\ No newline at end of file
+<div foo={foo} bar={bar}></div>