As discussed via security report, pug-attrs/index.js line 78 concatenates attribute names directly into generated JavaScript without calling stringify(), while the object-format branch at line 91 correctly uses stringify(key).
This is a hardening improvement, not a security vulnerability (template source is trusted input by design).
Suggested fix at line 78:
// Before:
buf += key + '=';
// After:
buf += stringify(key) + '=';
This ensures consistent escaping between both code branches.
As discussed via security report,
pug-attrs/index.jsline 78 concatenates attribute names directly into generated JavaScript without callingstringify(), while the object-format branch at line 91 correctly usesstringify(key).This is a hardening improvement, not a security vulnerability (template source is trusted input by design).
Suggested fix at line 78:
This ensures consistent escaping between both code branches.