{"action":"created","comment":{"url":"https://api.github.com/repos/aspnet/Mvc/pulls/comments/27360498","id":27360498,"diff_hunk":"@@ -366,26 +365,70 @@ public virtual void Write(object value)\n         /// </remarks>\n         public virtual void WriteTo([NotNull] TextWriter writer, object value)\n         {\n-            if (value != null && value != HtmlString.Empty)\n+            WriteTo(writer, HtmlEncoder, value, escapeQuotes: false);\n+        }\n+\n+        /// <summary>\n+        /// Writes the specified <paramref name=\"value\"/> with HTML encoding to given <paramref name=\"writer\"/>.\n+        /// </summary>\n+        /// <param name=\"writer\">The <see cref=\"TextWriter\"/> instance to write to.</param>\n+        /// <param name=\"encoder\">The <see cref=\"IHtmlEncoder\"/> to use when encoding <paramref name=\"value\"/>.</param>\n+        /// <param name=\"value\">The <see cref=\"object\"/> to write.</param>\n+        /// <param name=\"escapeQuotes\">\n+        /// If <c>true</c> escapes double quotes in a <paramref name=\"value\"/> of type <see cref=\"HtmlString\"/>.\n+        /// Otherwise writes <see cref=\"HtmlString\"/> values as-is.\n+        /// </param>\n+        /// <remarks>\n+        /// <paramref name=\"value\"/>s of type <see cref=\"HtmlString\"/> are written without encoding and the\n+        /// <see cref=\"HelperResult.WriteTo(TextWriter)\"/> is invoked for <see cref=\"HelperResult\"/> types.\n+        /// For all other types, the encoded result of <see cref=\"object.ToString\"/> is written to the\n+        /// <paramref name=\"writer\"/>.\n+        /// </remarks>\n+        public static void WriteTo(\n+            [NotNull] TextWriter writer,\n+            [NotNull] IHtmlEncoder encoder,\n+            object value,\n+            bool escapeQuotes)\n+        {\n+            if (value == null || value == HtmlString.Empty)\n             {\n-                var helperResult = value as HelperResult;\n-                if (helperResult != null)\n-                {\n-                    helperResult.WriteTo(writer);\n-                }\n-                else\n+                return;\n+            }\n+\n+            var helperResult = value as HelperResult;\n+            if (helperResult != null)\n+            {\n+                helperResult.WriteTo(writer);\n+                return;\n+            }\n+\n+            var htmlString = value as HtmlString;\n+            if (htmlString != null)\n+            {\n+                if (escapeQuotes)\n                 {\n-                    var htmlString = value as HtmlString;\n-                    if (htmlString != null)\n+                    // In this case the text likely came directly from the Razor source. Since the original string is\n+                    // an attribute value that may have been quoted with single quotes, must handle any double quotes\n+                    // in the value. Writing the value out surrounded by double quotes.","path":"src/Microsoft.AspNet.Mvc.Razor/RazorPage.cs","position":70,"original_position":70,"commit_id":"35136f60e31c7db034ab69d591731794cc1d2dee","original_commit_id":"35136f60e31c7db034ab69d591731794cc1d2dee","user":{"login":"dougbu","id":6431421,"avatar_url":"https://avatars.githubusercontent.com/u/6431421?v=3","gravatar_id":"","url":"https://api.github.com/users/dougbu","html_url":"https://github.com/dougbu","followers_url":"https://api.github.com/users/dougbu/followers","following_url":"https://api.github.com/users/dougbu/following{/other_user}","gists_url":"https://api.github.com/users/dougbu/gists{/gist_id}","starred_url":"https://api.github.com/users/dougbu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dougbu/subscriptions","organizations_url":"https://api.github.com/users/dougbu/orgs","repos_url":"https://api.github.com/users/dougbu/repos","events_url":"https://api.github.com/users/dougbu/events{/privacy}","received_events_url":"https://api.github.com/users/dougbu/received_events","type":"User","site_admin":false},"body":"didn't need to worry about this case before, when we were overzealous about HTML encoding","created_at":"2015-03-29T23:13:40Z","updated_at":"2015-03-29T23:13:40Z","html_url":"https://github.com/aspnet/Mvc/pull/2288#discussion_r27360498","pull_request_url":"https://api.github.com/repos/aspnet/Mvc/pulls/2288","_links":{"self":{"href":"https://api.github.com/repos/aspnet/Mvc/pulls/comments/27360498"},"html":{"href":"https://github.com/aspnet/Mvc/pull/2288#discussion_r27360498"},"pull_request":{"href":"https://api.github.com/repos/aspnet/Mvc/pulls/2288"}}},"pull_request":{"url":"https://api.github.com/repos/aspnet/Mvc/pulls/2288","id":32190217,"html_url":"https://github.com/aspnet/Mvc/pull/2288","diff_url":"https://github.com/aspnet/Mvc/pull/2288.diff","patch_url":"https://github.com/aspnet/Mvc/pull/2288.patch","issue_url":"https://api.github.com/repos/aspnet/Mvc/issues/2288","number":2288,"state":"open","locked":false,"title":"MVC portion of aspnet/Razor#335","user":{"login":"dougbu","id":6431421,"avatar_url":"https://avatars.githubusercontent.com/u/6431421?v=3","gravatar_id":"","url":"https://api.github.com/users/dougbu","html_url":"https://github.com/dougbu","followers_url":"https://api.github.com/users/dougbu/followers","following_url":"https://api.github.com/users/dougbu/following{/other_user}","gists_url":"https://api.github.com/users/dougbu/gists{/gist_id}","starred_url":"https://api.github.com/users/dougbu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dougbu/subscriptions","organizations_url":"https://api.github.com/users/dougbu/orgs","repos_url":"https://api.github.com/users/dougbu/repos","events_url":"https://api.github.com/users/dougbu/events{/privacy}","received_events_url":"https://api.github.com/users/dougbu/received_events","type":"User","site_admin":false},"body":"- set correct `MarkAsHtmlEncodedMethodName` value in `MvcRazorHost`\r\n- handle `HtmlString` values in `TagHelperOutput.Attributes` in `RazorPage`\r\n - special-case double-quotes in `HtmlString` values\r\n - add `static WriteTo()` method for use in tag helpers\r\n- handle non-`string` `output.Attributes` values in tag helpers\r\n- provide a `TagHelperContent.Append(object, ...)` extension method\r\n- add `LinkTagHelper.Href` and `ScriptTagHelper.Src` properties\r\n - avoid Razor HTML-encoding these attribute values before their use\r\n- add `JavaScriptEncoder` properties in `LinkTagHelper` and `ScriptTagHelper`\r\n - allow encoding testing without unit testing the default encoder\r\n- handle MVC and Razor changes for this bug in existing tests\r\n- add functional tests of encodings\r\n- add test encoders to TestCommon project\r\n\r\nnits:\r\n- correct `InputTagHelper` to pass `type=\"\"` through unchanged\r\n- set correct `TagHelperContentTypeName` value in `MvcRazorHost`\r\n- remove unnecessary `FormTagHelper.Method` and `OptionTagHelper.Selected` properties\r\n- remove complex ternaries and `ShouldAddFileVersion()` methods\r\n- add a few debug assertions\r\n- fix some odd wrapping\r\n- remove or `#if`-out unused `using`s\r\n- remove trailing whitespace\r\n\r\ntodo:\r\n- find a reliable way to handle bound attributes that are URLs\r\n - currently HTML- or JavaScript-encoded, incorrectly escaping `&` in HTML case","created_at":"2015-03-29T23:10:29Z","updated_at":"2015-03-29T23:13:40Z","closed_at":null,"merged_at":null,"merge_commit_sha":"0cd874edd863529b04c1ff0fd5f3bc6f3c4c3b05","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/aspnet/Mvc/pulls/2288/commits","review_comments_url":"https://api.github.com/repos/aspnet/Mvc/pulls/2288/comments","review_comment_url":"https://api.github.com/repos/aspnet/Mvc/pulls/comments{/number}","comments_url":"https://api.github.com/repos/aspnet/Mvc/issues/2288/comments","statuses_url":"https://api.github.com/repos/aspnet/Mvc/statuses/35136f60e31c7db034ab69d591731794cc1d2dee","head":{"label":"aspnet:dougbu/bound.not.encoded.razor.335","ref":"dougbu/bound.not.encoded.razor.335","sha":"35136f60e31c7db034ab69d591731794cc1d2dee","user":{"login":"aspnet","id":6476660,"avatar_url":"https://avatars.githubusercontent.com/u/6476660?v=3","gravatar_id":"","url":"https://api.github.com/users/aspnet","html_url":"https://github.com/aspnet","followers_url":"https://api.github.com/users/aspnet/followers","following_url":"https://api.github.com/users/aspnet/following{/other_user}","gists_url":"https://api.github.com/users/aspnet/gists{/gist_id}","starred_url":"https://api.github.com/users/aspnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aspnet/subscriptions","organizations_url":"https://api.github.com/users/aspnet/orgs","repos_url":"https://api.github.com/users/aspnet/repos","events_url":"https://api.github.com/users/aspnet/events{/privacy}","received_events_url":"https://api.github.com/users/aspnet/received_events","type":"Organization","site_admin":false},"repo":{"id":15126429,"name":"Mvc","full_name":"aspnet/Mvc","owner":{"login":"aspnet","id":6476660,"avatar_url":"https://avatars.githubusercontent.com/u/6476660?v=3","gravatar_id":"","url":"https://api.github.com/users/aspnet","html_url":"https://github.com/aspnet","followers_url":"https://api.github.com/users/aspnet/followers","following_url":"https://api.github.com/users/aspnet/following{/other_user}","gists_url":"https://api.github.com/users/aspnet/gists{/gist_id}","starred_url":"https://api.github.com/users/aspnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aspnet/subscriptions","organizations_url":"https://api.github.com/users/aspnet/orgs","repos_url":"https://api.github.com/users/aspnet/repos","events_url":"https://api.github.com/users/aspnet/events{/privacy}","received_events_url":"https://api.github.com/users/aspnet/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/aspnet/Mvc","description":"Model view controller framework for building dynamic web sites with clean separation of concerns, including the merged MVC, Web API, and Web Pages w/ Razor.","fork":false,"url":"https://api.github.com/repos/aspnet/Mvc","forks_url":"https://api.github.com/repos/aspnet/Mvc/forks","keys_url":"https://api.github.com/repos/aspnet/Mvc/keys{/key_id}","collaborators_url":"https://api.github.com/repos/aspnet/Mvc/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/aspnet/Mvc/teams","hooks_url":"https://api.github.com/repos/aspnet/Mvc/hooks","issue_events_url":"https://api.github.com/repos/aspnet/Mvc/issues/events{/number}","events_url":"https://api.github.com/repos/aspnet/Mvc/events","assignees_url":"https://api.github.com/repos/aspnet/Mvc/assignees{/user}","branches_url":"https://api.github.com/repos/aspnet/Mvc/branches{/branch}","tags_url":"https://api.github.com/repos/aspnet/Mvc/tags","blobs_url":"https://api.github.com/repos/aspnet/Mvc/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/aspnet/Mvc/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/aspnet/Mvc/git/refs{/sha}","trees_url":"https://api.github.com/repos/aspnet/Mvc/git/trees{/sha}","statuses_url":"https://api.github.com/repos/aspnet/Mvc/statuses/{sha}","languages_url":"https://api.github.com/repos/aspnet/Mvc/languages","stargazers_url":"https://api.github.com/repos/aspnet/Mvc/stargazers","contributors_url":"https://api.github.com/repos/aspnet/Mvc/contributors","subscribers_url":"https://api.github.com/repos/aspnet/Mvc/subscribers","subscription_url":"https://api.github.com/repos/aspnet/Mvc/subscription","commits_url":"https://api.github.com/repos/aspnet/Mvc/commits{/sha}","git_commits_url":"https://api.github.com/repos/aspnet/Mvc/git/commits{/sha}","comments_url":"https://api.github.com/repos/aspnet/Mvc/comments{/number}","issue_comment_url":"https://api.github.com/repos/aspnet/Mvc/issues/comments{/number}","contents_url":"https://api.github.com/repos/aspnet/Mvc/contents/{+path}","compare_url":"https://api.github.com/repos/aspnet/Mvc/compare/{base}...{head}","merges_url":"https://api.github.com/repos/aspnet/Mvc/merges","archive_url":"https://api.github.com/repos/aspnet/Mvc/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/aspnet/Mvc/downloads","issues_url":"https://api.github.com/repos/aspnet/Mvc/issues{/number}","pulls_url":"https://api.github.com/repos/aspnet/Mvc/pulls{/number}","milestones_url":"https://api.github.com/repos/aspnet/Mvc/milestones{/number}","notifications_url":"https://api.github.com/repos/aspnet/Mvc/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/aspnet/Mvc/labels{/name}","releases_url":"https://api.github.com/repos/aspnet/Mvc/releases{/id}","created_at":"2013-12-12T03:54:00Z","updated_at":"2015-03-29T22:10:32Z","pushed_at":"2015-03-29T23:10:29Z","git_url":"git://github.com/aspnet/Mvc.git","ssh_url":"git@github.com:aspnet/Mvc.git","clone_url":"https://github.com/aspnet/Mvc.git","svn_url":"https://github.com/aspnet/Mvc","homepage":"","size":96611,"stargazers_count":1549,"watchers_count":1549,"language":"C#","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":492,"mirror_url":null,"open_issues_count":213,"forks":492,"open_issues":213,"watchers":1549,"default_branch":"dev"}},"base":{"label":"aspnet:release","ref":"release","sha":"9402f1485ccc245f874d5d530f8c8a1ad54f3ced","user":{"login":"aspnet","id":6476660,"avatar_url":"https://avatars.githubusercontent.com/u/6476660?v=3","gravatar_id":"","url":"https://api.github.com/users/aspnet","html_url":"https://github.com/aspnet","followers_url":"https://api.github.com/users/aspnet/followers","following_url":"https://api.github.com/users/aspnet/following{/other_user}","gists_url":"https://api.github.com/users/aspnet/gists{/gist_id}","starred_url":"https://api.github.com/users/aspnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aspnet/subscriptions","organizations_url":"https://api.github.com/users/aspnet/orgs","repos_url":"https://api.github.com/users/aspnet/repos","events_url":"https://api.github.com/users/aspnet/events{/privacy}","received_events_url":"https://api.github.com/users/aspnet/received_events","type":"Organization","site_admin":false},"repo":{"id":15126429,"name":"Mvc","full_name":"aspnet/Mvc","owner":{"login":"aspnet","id":6476660,"avatar_url":"https://avatars.githubusercontent.com/u/6476660?v=3","gravatar_id":"","url":"https://api.github.com/users/aspnet","html_url":"https://github.com/aspnet","followers_url":"https://api.github.com/users/aspnet/followers","following_url":"https://api.github.com/users/aspnet/following{/other_user}","gists_url":"https://api.github.com/users/aspnet/gists{/gist_id}","starred_url":"https://api.github.com/users/aspnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aspnet/subscriptions","organizations_url":"https://api.github.com/users/aspnet/orgs","repos_url":"https://api.github.com/users/aspnet/repos","events_url":"https://api.github.com/users/aspnet/events{/privacy}","received_events_url":"https://api.github.com/users/aspnet/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/aspnet/Mvc","description":"Model view controller framework for building dynamic web sites with clean separation of concerns, including the merged MVC, Web API, and Web Pages w/ Razor.","fork":false,"url":"https://api.github.com/repos/aspnet/Mvc","forks_url":"https://api.github.com/repos/aspnet/Mvc/forks","keys_url":"https://api.github.com/repos/aspnet/Mvc/keys{/key_id}","collaborators_url":"https://api.github.com/repos/aspnet/Mvc/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/aspnet/Mvc/teams","hooks_url":"https://api.github.com/repos/aspnet/Mvc/hooks","issue_events_url":"https://api.github.com/repos/aspnet/Mvc/issues/events{/number}","events_url":"https://api.github.com/repos/aspnet/Mvc/events","assignees_url":"https://api.github.com/repos/aspnet/Mvc/assignees{/user}","branches_url":"https://api.github.com/repos/aspnet/Mvc/branches{/branch}","tags_url":"https://api.github.com/repos/aspnet/Mvc/tags","blobs_url":"https://api.github.com/repos/aspnet/Mvc/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/aspnet/Mvc/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/aspnet/Mvc/git/refs{/sha}","trees_url":"https://api.github.com/repos/aspnet/Mvc/git/trees{/sha}","statuses_url":"https://api.github.com/repos/aspnet/Mvc/statuses/{sha}","languages_url":"https://api.github.com/repos/aspnet/Mvc/languages","stargazers_url":"https://api.github.com/repos/aspnet/Mvc/stargazers","contributors_url":"https://api.github.com/repos/aspnet/Mvc/contributors","subscribers_url":"https://api.github.com/repos/aspnet/Mvc/subscribers","subscription_url":"https://api.github.com/repos/aspnet/Mvc/subscription","commits_url":"https://api.github.com/repos/aspnet/Mvc/commits{/sha}","git_commits_url":"https://api.github.com/repos/aspnet/Mvc/git/commits{/sha}","comments_url":"https://api.github.com/repos/aspnet/Mvc/comments{/number}","issue_comment_url":"https://api.github.com/repos/aspnet/Mvc/issues/comments{/number}","contents_url":"https://api.github.com/repos/aspnet/Mvc/contents/{+path}","compare_url":"https://api.github.com/repos/aspnet/Mvc/compare/{base}...{head}","merges_url":"https://api.github.com/repos/aspnet/Mvc/merges","archive_url":"https://api.github.com/repos/aspnet/Mvc/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/aspnet/Mvc/downloads","issues_url":"https://api.github.com/repos/aspnet/Mvc/issues{/number}","pulls_url":"https://api.github.com/repos/aspnet/Mvc/pulls{/number}","milestones_url":"https://api.github.com/repos/aspnet/Mvc/milestones{/number}","notifications_url":"https://api.github.com/repos/aspnet/Mvc/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/aspnet/Mvc/labels{/name}","releases_url":"https://api.github.com/repos/aspnet/Mvc/releases{/id}","created_at":"2013-12-12T03:54:00Z","updated_at":"2015-03-29T22:10:32Z","pushed_at":"2015-03-29T23:10:29Z","git_url":"git://github.com/aspnet/Mvc.git","ssh_url":"git@github.com:aspnet/Mvc.git","clone_url":"https://github.com/aspnet/Mvc.git","svn_url":"https://github.com/aspnet/Mvc","homepage":"","size":96611,"stargazers_count":1549,"watchers_count":1549,"language":"C#","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":492,"mirror_url":null,"open_issues_count":213,"forks":492,"open_issues":213,"watchers":1549,"default_branch":"dev"}},"_links":{"self":{"href":"https://api.github.com/repos/aspnet/Mvc/pulls/2288"},"html":{"href":"https://github.com/aspnet/Mvc/pull/2288"},"issue":{"href":"https://api.github.com/repos/aspnet/Mvc/issues/2288"},"comments":{"href":"https://api.github.com/repos/aspnet/Mvc/issues/2288/comments"},"review_comments":{"href":"https://api.github.com/repos/aspnet/Mvc/pulls/2288/comments"},"review_comment":{"href":"https://api.github.com/repos/aspnet/Mvc/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/aspnet/Mvc/pulls/2288/commits"},"statuses":{"href":"https://api.github.com/repos/aspnet/Mvc/statuses/35136f60e31c7db034ab69d591731794cc1d2dee"}}}}