fix(unhead): parse HTML attribute values without backslash escaping (#774)

harlan-zw · web-flow · commit 88c9d6d1dfa0 · 2026-06-12T13:08:55.000+10:00
diff --git a/packages/unhead/src/parser/index.ts b/packages/unhead/src/parser/index.ts
@@ -195,10 +195,10 @@ export function parseAttributes(attrStr: string): Record<string, string> {
         break
 
       case QUOTED_VALUE:
-        if (charCode === BACKSLASH_CHAR && i + 1 < len) {
-          i++
-        }
-        else if (charCode === quoteChar) {
+        // HTML attribute values have no backslash escaping; the quote char
+        // always terminates the value (matches browser parsing and the
+        // tag-boundary scanner above).
+        if (charCode === quoteChar) {
           result[name] = attrStr.substring(valueStart, i)
           state = WHITESPACE
         }
diff --git a/packages/unhead/test/unit/parser/parseAttributes.test.ts b/packages/unhead/test/unit/parser/parseAttributes.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest'
+import { parseAttributes } from '../../../src/parser'
+
+describe('parseAttributes', () => {
+  it('treats backslash as a literal char in quoted values', () => {
+    // HTML has no backslash escaping in attribute values, so a trailing
+    // backslash must not consume the closing quote.
+    expect(parseAttributes('href="C:\\"')).toEqual({ href: 'C:\\' })
+  })
+
+  it('does not let a backslash swallow the closing quote of an attribute', () => {
+    expect(parseAttributes('content="a\\" name="description"')).toEqual({
+      content: 'a\\',
+      name: 'description',
+    })
+  })
+
+  it('parses basic quoted and unquoted attributes', () => {
+    expect(parseAttributes('name="description" content=hello disabled')).toEqual({
+      name: 'description',
+      content: 'hello',
+      disabled: '',
+    })
+  })
+})
