From 027cd64af04d00bfe047777ca21e342c52309abb Mon Sep 17 00:00:00 2001
From: Sebastian Wick <sebastian.wick@redhat.com>
Date: Mon, 29 Jun 2026 22:45:58 +0200
Subject: [PATCH] xml-utils: Escape XML attribute values when serializing

---
 common/flatpak-xml-utils.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/common/flatpak-xml-utils.c b/common/flatpak-xml-utils.c
index 2b433dd61..65dc211f1 100644
--- a/common/flatpak-xml-utils.c
+++ b/common/flatpak-xml-utils.c
@@ -165,9 +165,12 @@ flatpak_xml_to_string (FlatpakXml *node, GString *res)
             {
               for (i = 0; node->attribute_names[i] != NULL; i++)
                 {
+                  g_autofree char *value = NULL;
+
+                  value = g_markup_escape_text (node->attribute_values[i], -1);
                   g_string_append_printf (res, " %s=\"%s\"",
                                           node->attribute_names[i],
-                                          node->attribute_values[i]);
+                                          value);
                 }
             }
           if (node->first_child == NULL)