Repository: gohugoio/hugo (language: go)

Issue:
`alt` text in images does not escape any double quotes

### What version of Hugo are you using (`hugo version`)?

<pre>
$ hugo version

hugo v0.92.2+extended linux/amd64 BuildDate=unknown

</pre>

### Does this issue reproduce with the latest release?

Yes

### Issue

For the given Markdown:

```markdown
![Referrer breakdown to "Search Engines", "Direct Entry" and "Websites"](https://media.jvt.me/94fec39807.png)
```

The following HTML is rendered:

```html
<p><img src="https://media.jvt.me/94fec39807.png" alt="Referrer breakdown to "Search Engines", "Direct Entry" and "Websites""></p>
```

But note that the quotes are not escaped, which trips up some HTML parsers.


Discussion / hints:
Is this the default renderer? No image render hook used?
Seems like it, I have no render hooks and a copy paste did exactly that. 

![20220302-21:03:37_Selection_001](https://user-images.githubusercontent.com/83281/156376546-6d1dd188-b154-43d9-88a3-c5a9cbb6618d.png)

with 0.93.1


OK, so a fresh site does _not_ have this, it's definitely related to the following configuration in my `config.toml`:

```toml
[markup]
  [markup.goldmark]
    [markup.goldmark.extensions]
    typographer = false
    [markup.goldmark.renderer]
    # allow inline HTML, such as spoiler warnings
    unsafe = true
  [markup.tableOfContents]
  startLevel = 1
  endLevel = 6
  ordered = false
```
It appears to be related to the `typographer` configuration, as with it set, we see:

```html
<p><img src="https://media.jvt.me/94fec39807.png" alt="Referrer breakdown to &ldquo;Search Engines&rdquo;, &ldquo;Direct Entry&rdquo; and &ldquo;Websites&rdquo;"></p>
```
my markup config:

```toml
################################################################################
# see https://github.com/yuin/goldmark/#built-in-extensions
# see https://gohugo.io/getting-started/configuration-markup#goldmark
################################################################################
[goldmark]

[goldmark.extensions]
definitionList = true
footnote = true
linkify = true
strikethrough = true
table = true
taskList = true
typographer = true

[goldmark.parser]
attribute = true
autoHeadingID = true
autoHeadingIDType = "github"

[goldmark.renderer]
hardWraps = false
unsafe = false
xhtml = false

[highlight]
anchorLineNos = true
codeFences = true
guessSyntax = true
lineAnchors = "code"
lineNos = true
lineNumbersInTable = true
noClasses = false
tabWidth = 2
style = "xcode"

[tableOfContents]
endLevel = 4
ordered = false
startLevel = 2
```

My `typographer` is `true`. 
This is what I'm testing with:

<details>

<summary><code>content/posts/hello.md</code></summary>

```markdown
---
title: hi
---

The post

![the "example"](https://media.jvt.me)


![Referrer breakdown to "Search Engines", "Direct Entry" and "Websites"](https://media.jvt.me/94fec39807.png)

another
```

</details>

<details>

<summary><code>layouts/posts/single.html</code></summary>

```html
<article id="content">
  {{ .Content }}
</article>
```

</details>

<details>

<summary><code>config.toml</code></summary>

```toml
baseURL = 'http://example.org/'
languageCode = 'en-us'
title = 'My New Hugo Site'
```

</details>

Which renders (on Hugo v92.2 and v93.0):

```html
<article id="content">
  <p>The post</p>
<p><img src="https://media.jvt.me" alt="the &ldquo;example&rdquo;"></p>
<p><img src="https://media.jvt.me/94fec39807.png" alt="Referrer breakdown to &ldquo;Search Engines&rdquo;, &ldquo;Direct Entry&rdquo; and &ldquo;Websites&rdquo;"></p>
<p>another</p>

</article>
```

~Note that I don't see a configuration change when I have `[goldmark]` but I do when I have `[markup.goldmark]`.~

I'm currently thinking that the `typographer` is what's causing this
I have `[goldmark]` because the configuration is in `config/_default/markup.toml`. In that case it does not require the `markup.` part.
1\) This is not new behavior. You can reproduce the problem with v0.60.0 and later, when Goldmark became the default markdown renderer.

2\) Enabling the Goldmark typographer extension _masks_ the problem; disabling the extension does not _trigger_ it.

3\) This is not a Goldmark bug. This:

```go
func main() {
	md := goldmark.New()

	input := `!["a"](b)`

	var buf bytes.Buffer
	if err := md.Convert([]byte(input), &buf); err != nil {
		panic(err)
	}

	fmt.Println(buf.String())

}
```

produces this:

```html
<p><img src="b" alt="&quot;a&quot;"></p>
```

which conforms to the CommonMark spec ([example](https://spec.commonmark.org/dingus/?text=!%5B%22a%22%5D(b)%0A)).

Fix patch:
diff --git a/markup/goldmark/render_hooks.go b/markup/goldmark/render_hooks.go
index d5e35380a11..138a60d263b 100644
--- a/markup/goldmark/render_hooks.go
+++ b/markup/goldmark/render_hooks.go
@@ -175,7 +175,7 @@ func (r *hookedRenderer) renderImageDefault(w util.BufWriter, source []byte, nod
 		_, _ = w.Write(util.EscapeHTML(util.URLEscape(n.Destination, true)))
 	}
 	_, _ = w.WriteString(`" alt="`)
-	_, _ = w.Write(n.Text(source))
+	_, _ = w.Write(util.EscapeHTML(n.Text(source)))
 	_ = w.WriteByte('"')
 	if n.Title != nil {
 		_, _ = w.WriteString(` title="`)


Test patch:
diff --git a/markup/goldmark/integration_test.go b/markup/goldmark/integration_test.go
index 16705ad6290..89cd5bbb644 100644
--- a/markup/goldmark/integration_test.go
+++ b/markup/goldmark/integration_test.go
@@ -394,3 +394,32 @@ FENCE
 		builders[i].Build()
 	}
 }
+
+// Issue 9594
+func TestQuotesInImgAltAttr(t *testing.T) {
+	t.Parallel()
+
+	files := `
+-- config.toml --
+[markup.goldmark.extensions]
+  typographer = false
+-- content/p1.md --
+---
+title: "p1"
+---
+!["a"](b.jpg)
+-- layouts/_default/single.html --
+{{ .Content }}
+`
+
+	b := hugolib.NewIntegrationTestBuilder(
+		hugolib.IntegrationTestConfig{
+			T:           t,
+			TxtarString: files,
+		},
+	).Build()
+
+	b.AssertFileContent("public/p1/index.html", `
+		<img src="b.jpg" alt="&quot;a&quot;">
+	`)
+}