fix(atom): escape & in category attribute values

src/__tests__/atom1.spec.ts

@@ -42,6 +42,28 @@ describe("atom 1.0", () => {
     expect(actual).toContain('<link rel="enclosure" href="https://example.com/hello&amp;world.png"');
   });
 
+  it("should escape & in category attributes", () => {
+    const feed = new Feed({
+      title: "Feed Title",
+      id: "http://example.com/",
+      link: "http://example.com/",
+      updated,
+    });
+    feed.addCategory("Arts & Crafts");
+    feed.addItem({
+      title: "Hello World",
+      link: "http://example.org/2013/12/14",
+      date: updated,
+      category: [{ name: "R&D", scheme: "https://example.com/s?a=1&b=2" }],
+    });
+    const actual = feed.atom1();
+    // unlike a text node, xml-js does not escape `&` inside an attribute value,
+    // so it must be escaped before being handed to the serializer
+    expect(actual).toContain('<category term="Arts &amp; Crafts"/>');
+    expect(actual).toContain('<category label="R&amp;D" scheme="https://example.com/s?a=1&amp;b=2"/>');
+    expect(actual).not.toContain("Arts & Crafts");
+  });
+
   it("should emit the default generator when none is provided", () => {
     const feed = new Feed({ title: "Feed Title", id: "https://example.com/", link: "https://example.com/" });
     expect(feed.atom1()).toContain("<generator>https://github.com/jpmonette/feed</generator>");

src/atom1.ts

@@ -11,7 +11,7 @@
 export default (ins: Feed) => {
   const { options } = ins;
 
   const base: any = {
     _declaration: { _attributes: { version: "1.0", encoding: "utf-8" } },
     _instruction: {},
     feed: {
@@ -82,7 +82,7 @@
   base.feed.category = [];
 
   ins.categories.forEach((category: string) => {
-    base.feed.category.push({ _attributes: { term: category } });
+    base.feed.category.push({ _attributes: { term: sanitize(category) } });
   });
 
   base.feed.contributor = [];
@@ -227,12 +227,12 @@
 const formatEnclosure = (enclosure: string | Enclosure, mimeCategory = "image") => {
   if (typeof enclosure === "string") {
     const sanitizedUrl = sanitize(enclosure);
     const type = new URL(sanitizedUrl!).pathname.split(".").slice(-1)[0];
     return { _attributes: { rel: "enclosure", href: sanitizedUrl, type: `${mimeCategory}/${type}` } };
   }
 
   const sanitizedUrl = sanitize(enclosure.url);
   const type = new URL(sanitizedUrl!).pathname.split(".").slice(-1)[0];
   return {
     _attributes: {
       rel: "enclosure",
@@ -253,9 +253,9 @@
 
   return {
     _attributes: {
-      label: name,
-      scheme,
-      term,
+      label: sanitize(name),
+      scheme: sanitize(scheme),
+      term: sanitize(term),
     },
   };
 };