From e4a6305a50600fe70ac090926193e03e731066e1 Mon Sep 17 00:00:00 2001
From: Timothy DeHerrera <tim@nrdxp.dev>
Date: Thu, 5 Feb 2026 17:07:54 -0700
Subject: [PATCH] fix(escape): add single-quote escaping to html_escape
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add '\'' → '&#39;' case to html_escape_into for complete XSS
protection in HTML attribute contexts. Update documentation
and add test case.

Addresses LOW severity finding from security audit.
---
 src/escape.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/escape.rs b/src/escape.rs
index ba0ba5a..334623d 100644
--- a/src/escape.rs
+++ b/src/escape.rs
@@ -2,7 +2,7 @@
 
 /// Escape HTML special characters for safe embedding in HTML content.
 ///
-/// Escapes: `&`, `<`, `>`, `"`
+/// Escapes: `&`, `<`, `>`, `"`, `'`
 pub fn html_escape(s: &str) -> String {
     let mut result = String::with_capacity(s.len());
     html_escape_into(&mut result, s);
@@ -19,6 +19,7 @@ pub fn html_escape_into(out: &mut String, s: &str) {
             '<' => out.push_str("&lt;"),
             '>' => out.push_str("&gt;"),
             '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&#39;"),
             _ => out.push(c),
         }
     }
@@ -44,6 +45,7 @@ mod tests {
         assert_eq!(html_escape("Hello & World"), "Hello &amp; World");
         assert_eq!(html_escape("<tag>"), "&lt;tag&gt;");
         assert_eq!(html_escape("\"quoted\""), "&quot;quoted&quot;");
+        assert_eq!(html_escape("it's"), "it&#39;s");
     }
 
     #[test]