Attributes are not being escaped

Fixes #23

tests/test_dsl.py

@@ -52,7 +52,7 @@ def test_style_empty_dict() -> None:
     assert html == '<div style="">\n</div>\n'
 
 
-def test_unsafe_text() -> None:
+def test_safe_content_is_not_escaped() -> None:
     html = render(h("div", safe("<script>alert(1)</script>")))
     assert html == dedent(
         """\
@@ -63,7 +63,7 @@ def test_unsafe_text() -> None:
     )
 
 
-def test_safe_text() -> None:
+def test_content_is_escaped() -> None:
     html = render(h("div", "<script>alert(1)</script>"))
     assert html == dedent(
         """\
@@ -74,6 +74,16 @@ def test_safe_text() -> None:
     )
 
 
+def test_attributes_are_escaped() -> None:
+    html = render(h("div", {"id": "<script>alert(1)</script>"}))
+    assert html == dedent(
+        """\
+        <div id="<script>alert(1)</script>">
+        </div>
+        """
+    )
+
+
 def test_empty_string_boolean_attribute() -> None:
     html = render(h("input", {"disabled": ""}))
     assert html == "<input disabled>\n"