From 3337cfdc4ab921c1ac85dea254b6b94f88155476 Mon Sep 17 00:00:00 2001
From: "Andrew M. Kuchling" <amk@amk.ca>
Date: Fri, 9 Jun 2006 14:00:15 +0000
Subject: [PATCH] [Bug #1472827] Correctly escape newlines and tabs in
 attribute values in saxutils.XMLGenerator

---
 Lib/test/test_sax.py    | 7 +++++--
 Lib/xml/sax/saxutils.py | 2 ++
 Misc/NEWS               | 4 ++++
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/Lib/test/test_sax.py b/Lib/test/test_sax.py
index 210ca196660d..c2549ca678a9 100644
--- a/Lib/test/test_sax.py
+++ b/Lib/test/test_sax.py
@@ -175,11 +175,14 @@ def test_xmlgen_attr_escape():
     gen.endElement("e")
     gen.startElement("e", {"a": "'\""})
     gen.endElement("e")
+    gen.startElement("e", {"a": "\n\r\t"})
+    gen.endElement("e")
     gen.endElement("doc")
     gen.endDocument()
 
-    return result.getvalue() == start \
-           + "<doc a='\"'><e a=\"'\"></e><e a=\"'&quot;\"></e></doc>"
+    return result.getvalue() == start + ("<doc a='\"'><e a=\"'\"></e>"
+                                         "<e a=\"'&quot;\"></e>"
+                                         "<e a=\"&#10;&#13;&#9;\"></e></doc>")
 
 def test_xmlgen_ignorable():
     result = StringIO()
diff --git a/Lib/xml/sax/saxutils.py b/Lib/xml/sax/saxutils.py
index 582b0089c4bf..a4965192fa83 100644
--- a/Lib/xml/sax/saxutils.py
+++ b/Lib/xml/sax/saxutils.py
@@ -68,6 +68,8 @@ def quoteattr(data, entities={}):
     the optional entities parameter.  The keys and values must all be
     strings; each key will be replaced with its corresponding value.
     """
+    entities = entities.copy()
+    entities.update({'\n': '&#10;', '\r': '&#13;', '\t':'&#9;'})
     data = escape(data, entities)
     if '"' in data:
         if "'" in data:
diff --git a/Misc/NEWS b/Misc/NEWS
index de45cdd8255e..5230d9ac2f7b 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -69,6 +69,10 @@ Library
   raise an exception some day.  But dicts have been allowed, and "mostly
   worked", so support for them won't go away without warning.
 
+- Bug #1472827: correctly escape newlines and tabs in attribute values in
+  the saxutils.XMLGenerator class.
+
+
 Tools/Demos
 -----------
 
-- 
2.47.3