Fix accidental entities

...by encoding loose ampersands.

Author: wooorm

lib/index.js

@@ -20,6 +20,7 @@ module.exports = toHTML;
 
 /* Characters. */
 var NULL = '\0';
+var AMP = '&';
 var SPACE = ' ';
 var TAB = '\t';
 var GR = '`';
@@ -34,7 +35,7 @@ var CR = '\r';
 var FF = '\f';
 
 /* https://html.spec.whatwg.org/#attribute-name-state */
-var NAME = [SPACE, TAB, LF, CR, FF, SO, GT, EQ];
+var NAME = [AMP, SPACE, TAB, LF, CR, FF, SO, GT, EQ];
 var CLEAN_NAME = NAME.concat(NULL, DQ, SQ, LT);
 
 /*
@@ -49,15 +50,15 @@ var CLEAN_NAME = NAME.concat(NULL, DQ, SQ, LT);
 var QUOTES = [DQ, SQ, GR];
 
 /* https://html.spec.whatwg.org/#attribute-value-(unquoted)-state */
-var UQ_VALUE = [SPACE, TAB, LF, CR, FF, GT];
+var UQ_VALUE = [AMP, SPACE, TAB, LF, CR, FF, GT];
 var UQ_VALUE_CLEAN = UQ_VALUE.concat(NULL, DQ, SQ, LT, EQ, GR);
 
 /* https://html.spec.whatwg.org/#attribute-value-(single-quoted)-state */
-var SQ_VALUE = [SQ];
+var SQ_VALUE = [AMP, SQ];
 var SQ_VALUE_CLEAN = SQ_VALUE.concat(NULL);
 
 /* https://html.spec.whatwg.org/#attribute-value-(double-quoted)-state */
-var DQ_VALUE = [DQ];
+var DQ_VALUE = [AMP, DQ];
 var DQ_VALUE_CLEAN = DQ_VALUE.concat(NULL);
 
 /**

lib/text.js

@@ -40,6 +40,6 @@ function text(ctx, node, index, parent) {
   var value = node.value;
 
   return isLiteral(parent) ? value : entities(value, xtend(ctx.entities, {
-    subset: ['<']
+    subset: ['<', '&']
   }));
 }

test/text.js

@@ -25,8 +25,8 @@ test('`text`', function (t) {
   );
 
   t.deepEqual(
-    to(u('text', '3 < 5')),
-    '3 &#x3C; 5',
+    to(u('text', '3 < 5 & 7')),
+    '3 &#x3C; 5 &#x26; 7',
     'should encode `text`s'
   );