Feat/attr escape

.gitignore

@@ -129,3 +129,5 @@ dmypy.json
 .pyre/
 
 .idea/
+.coverage
+junit.xml

json2xml/dicttoxml.py

@@ -127,7 +127,7 @@ def make_attrstring(attr: dict[str, Any]) -> str:
     Returns:
         str: The string of XML attributes.
     """
-    attrstring = " ".join([f'{k}="{v}"' for k, v in attr.items()])
+    attrstring = " ".join([f'{k}="{escape_xml(v)}"' for k, v in attr.items()])
     return f'{" " if attrstring != "" else ""}{attrstring}'
 
 

tests/test_dict2xml.py

@@ -3,7 +3,7 @@
 
 import pytest
 
-from json2xml import dicttoxml
+from json2xml import dicttoxml, json2xml
 
 
 class TestDict2xml:

tests/test_xml_escape.py

@@ -0,0 +1,56 @@
+import pytest
+import json
+
+from json2xml import dicttoxml, json2xml
+
+
+
+class TestEscaping:
+    def test_escaping(self):
+        # Test cases
+        test_cases = [
+            {
+                "root": {
+                    "@attrs": {
+                        "Text": "this & that"
+                    }
+                }
+            },
+            {
+                "data": json.dumps({"key": "value & more"})
+            },
+            {
+                "mixed": {
+                    "json_str": json.dumps({"a": "b & c"}),
+                    "plain": "text & symbols"
+                }
+            }
+        ]
+        for i, data in enumerate(test_cases):
+            print(f"\nTest case {i + 1}:")
+            print("Input:", data)
+            xml = dicttoxml.dicttoxml(data, custom_root='all')
+            print("Output XML:")
+            print(xml.decode('utf-8'))
+
+    def test_escapes_angle_brackets(self):
+        json_data = json.dumps({"root": {"@attrs": {"HelpText": "version <here>"}}})
+        result = json2xml.Json2xml(json_data).to_xml()
+        assert '"HelpText": "version &lt;here&gt;"' in result
+
+    def test_escapes_quotes(self):
+        json_data = json.dumps({"root": {"@attrs": {"Text": "\"quoted\""}}})
+        result = json2xml.Json2xml(json_data).to_xml()
+        assert '"Text": "\\"quoted\\""' in result
+
+    def test_escapes_ampersands(self):
+        json_data = json.dumps({"root": {"@attrs": {"Text": "this & that"}}})
+        result = json2xml.Json2xml(json_data).to_xml()
+        assert '"Text": "this &amp; that"' in result
+
+    def test_escapes_mixed_special_chars(self):
+        json_data = json.dumps({"root": {"@attrs": {"Text": "<tag> & \"quote\""}}})
+        result = json2xml.Json2xml(json_data).to_xml()
+        assert '"Text": "&lt;tag&gt; &amp; \\"quote\\""' in result
+
+