From e937060de21e59f16c30575770cc99b64a6a86e7 Mon Sep 17 00:00:00 2001
From: Rich Harris <richard.a.harris@gmail.com>
Date: Wed, 1 Aug 2018 16:56:42 -0400
Subject: [PATCH] add non-spread test for attribute safety

---
 .../_expected.html                               |  4 ++++
 .../attribute-escaped-quotes-spread/main.html    | 16 ++++++++++++++++
 .../attribute-escaped-quotes/_expected.html      |  1 -
 .../samples/attribute-escaped-quotes/main.html   |  8 ++------
 4 files changed, 22 insertions(+), 7 deletions(-)
 create mode 100644 test/server-side-rendering/samples/attribute-escaped-quotes-spread/_expected.html
 create mode 100644 test/server-side-rendering/samples/attribute-escaped-quotes-spread/main.html

diff --git a/test/server-side-rendering/samples/attribute-escaped-quotes-spread/_expected.html b/test/server-side-rendering/samples/attribute-escaped-quotes-spread/_expected.html
new file mode 100644
index 0000000000..bc31ce8bc3
--- /dev/null
+++ b/test/server-side-rendering/samples/attribute-escaped-quotes-spread/_expected.html
@@ -0,0 +1,4 @@
+<div
+	foo="&#34;></div><script>alert(42)</script>"
+	bar="&#39;></div><script>alert(42)</script>"
+></div>
\ No newline at end of file
diff --git a/test/server-side-rendering/samples/attribute-escaped-quotes-spread/main.html b/test/server-side-rendering/samples/attribute-escaped-quotes-spread/main.html
new file mode 100644
index 0000000000..669d7664ac
--- /dev/null
+++ b/test/server-side-rendering/samples/attribute-escaped-quotes-spread/main.html
@@ -0,0 +1,16 @@
+<div {...props}></div>
+
+<script>
+
+	export default {
+		data() {
+			return {
+				props: {
+					foo: '"></div><script>alert(42)</' + 'script>',
+					bar: "'></div><script>alert(42)</" + 'script>',
+					['"></div><script>alert(42)</' + 'script>']: 'baz'
+				}
+			};
+		}
+	};
+</script>
\ No newline at end of file
diff --git a/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html b/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html
index bc31ce8bc3..c3c9405d7b 100644
--- a/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html
+++ b/test/server-side-rendering/samples/attribute-escaped-quotes/_expected.html
@@ -1,4 +1,3 @@
 <div
 	foo="&#34;></div><script>alert(42)</script>"
-	bar="&#39;></div><script>alert(42)</script>"
 ></div>
\ No newline at end of file
diff --git a/test/server-side-rendering/samples/attribute-escaped-quotes/main.html b/test/server-side-rendering/samples/attribute-escaped-quotes/main.html
index 669d7664ac..47e3466ab0 100644
--- a/test/server-side-rendering/samples/attribute-escaped-quotes/main.html
+++ b/test/server-side-rendering/samples/attribute-escaped-quotes/main.html
@@ -1,15 +1,11 @@
-<div {...props}></div>
+<div foo={foo}></div>
 
 <script>
 
 	export default {
 		data() {
 			return {
-				props: {
-					foo: '"></div><script>alert(42)</' + 'script>',
-					bar: "'></div><script>alert(42)</" + 'script>',
-					['"></div><script>alert(42)</' + 'script>']: 'baz'
-				}
+				foo: '"></div><script>alert(42)</' + 'script>'
 			};
 		}
 	};