diff --git a/inline_test.go b/inline_test.go
index 48bf5f6..59afedb 100644
--- a/inline_test.go
+++ b/inline_test.go
@@ -204,16 +204,13 @@ func TestRawHtmlTag(t *testing.T) {
// Additonal token types: SelfClosing, Comment, DocType.
"
",
- "
\n",
+ "
\n",
"",
"\n",
"",
"<!DOCTYPE test>
\n",
-
- "
",
- "
\n",
}
doTestsInlineParam(t, tests, 0, HTML_SKIP_STYLE|HTML_SANITIZE_OUTPUT)
}
@@ -229,6 +226,21 @@ func TestQuoteEscaping(t *testing.T) {
doTestsInlineParam(t, tests, 0, HTML_SKIP_STYLE|HTML_SANITIZE_OUTPUT)
}
+func TestSanitizeSelfClosingTag(t *testing.T) {
+ tests := []string{
+ "
\n",
+ "
\n",
+
+ "
\n",
+ "
\n",
+
+ // Make sure that evil attributes are stripped for self closing tags.
+ "
\n",
+ "
\n",
+ }
+ doTestsInlineParam(t, tests, 0, HTML_SKIP_STYLE|HTML_SANITIZE_OUTPUT)
+}
+
func TestEmphasis(t *testing.T) {
var tests = []string{
"nothing inline\n",
diff --git a/sanitize.go b/sanitize.go
index 92a0cc3..68e9e03 100644
--- a/sanitize.go
+++ b/sanitize.go
@@ -103,7 +103,11 @@ func sanitizeHtmlSafe(input []byte) []byte {
wr.WriteByte('"')
}
}
- wr.WriteString(">")
+ if t == html.SelfClosingTagToken {
+ wr.WriteString("/>")
+ } else {
+ wr.WriteString(">")
+ }
} else {
wr.WriteString(html.EscapeString(string(tokenizer.Raw())))
}