From 0ebefd62932783f54110d0b48e515cd997c9e6e2 Mon Sep 17 00:00:00 2001
From: Daniel <845765@qq.com>
Date: Sun, 28 Dec 2025 15:32:10 +0800
Subject: [PATCH] :bug: Attribute values are not escaped
 https://github.com/siyuan-note/siyuan/pull/16712

Signed-off-by: Daniel <845765@qq.com>
---
 kernel/filesys/tree.go | 34 +++++-----------------------------
 1 file changed, 5 insertions(+), 29 deletions(-)

diff --git a/kernel/filesys/tree.go b/kernel/filesys/tree.go
index 6a66c8e45..ecb6a22fb 100644
--- a/kernel/filesys/tree.go
+++ b/kernel/filesys/tree.go
@@ -345,10 +345,8 @@ func escapeAttributeValues(tree *parse.Tree) (hasEscaped bool) {
 		if escaped := escapeNodeAttributeValues(n); escaped {
 			hasEscaped = true
 		}
-
 		return ast.WalkContinue
 	})
-
 	return hasEscaped
 }
 
@@ -358,34 +356,13 @@ func escapeNodeAttributeValues(node *ast.Node) (escaped bool) {
 		return false
 	}
 
-	attrs := parse.IAL2Map(node.KramdownIAL)
-	needsEscape := false
-	escapedAttrs := make(map[string]string)
-
-	for key, value := range attrs {
-		if needsEscapeForValue(value) {
-			escapedAttrs[key] = html.EscapeAttrVal(value)
-			needsEscape = true
+	for _, kv := range node.KramdownIAL {
+		if value := kv[1]; needsEscapeForValue(value) {
+			kv[1] = html.EscapeAttrVal(value)
+			escaped = true
 		}
 	}
-
-	if !needsEscape {
-		return false
-	}
-
-	oldAttrs := parse.IAL2Map(node.KramdownIAL)
-	newAttrs := make(map[string]string)
-	for k, v := range oldAttrs {
-		newAttrs[k] = v
-	}
-	for name, value := range escapedAttrs {
-		lowerName := strings.ToLower(name)
-		delete(newAttrs, name)
-		newAttrs[lowerName] = value
-	}
-	node.KramdownIAL = parse.Map2IAL(newAttrs)
-
-	return true
+	return
 }
 
 // needsEscapeForValue 检查值是否需要转义（包含需要转义的特殊字符但尚未被转义）
@@ -410,6 +387,5 @@ func needsEscapeForValue(value string) bool {
 			return false
 		}
 	}
-
 	return true
 }