From dc57def3d134ebf3e16d2abbccca769096f7d9e7 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 11 Nov 2026 14:32:16 +0000
Subject: [PATCH] address review: escape image attributes within the page's
 room

---
 crates/engine/src/io.rs | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/crates/engine/src/io.rs b/crates/engine/src/io.rs
index 950b2778a..6dd96b042 100644
--- a/crates/engine/src/io.rs
+++ b/crates/engine/src/io.rs
@@ -945,14 +945,10 @@ pub fn to_html(wb: &Workbook, sheet: usize) -> Result<String> {
             if out.len().saturating_add(im.data.len().div_ceil(3).saturating_mul(4)) > HTML_EXPORT_MAX_BYTES {
                 return Err(html_too_big());
             }
-            let _ = write!(
-                out,
-                "<img src=\"data:{};base64,{}\" alt=\"{}\" style=\"{}\">",
-                esc(&im.mime),
-                base64_encode(&im.data),
-                esc(&im.alt),
-                place(&im.anchor)
-            );
+            // The attributes are escaped only as far as the page has room for them.
+            let room = HTML_EXPORT_MAX_BYTES.saturating_sub(out.len());
+            let (Some(mime), Some(alt)) = (esc_within(&im.mime, room), esc_within(&im.alt, room)) else { return Err(html_too_big()) };
+            let _ = write!(out, "<img src=\"data:{mime};base64,{}\" alt=\"{alt}\" style=\"{}\">", base64_encode(&im.data), place(&im.anchor));
             if out.len() > HTML_EXPORT_MAX_BYTES {
                 return Err(html_too_big());
             }