Redmine

Looks like an environment issue, since both the test and actual code are escaping quotes (img src="...):

# Test
<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
  <title></title>
  <link href="http://test.host/issues/2.atom" rel="self"/>
  <link href="http://test.host/" rel="alternate"/>
  <id>http://test.host/</id>
  <updated>2009-11-10T00:00:00-08:00</updated>
  <author>
    <name>Redmine</name>
  </author>
  <entry>
    <title>eCookbook - Feature request #2: Add ingredients categories</title>
    <link href="http://test.host/issues/2" rel="alternate"/>
    <id>http://test.host/issues/2?journal_id=3</id>
    <updated>2009-11-10T00:00:00-08:00</updated>
    <author>
      <name>John Smith</name>
      <email>jsmith@somenet.foo</email>
    </author>
    <content type="html">
&lt;ul&gt;&lt;/ul&gt;&lt;p&gt;A comment with inline image: &lt;img src=&quot;http://test.host/attachments/download/10&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;    </content>
  </entry>
</feed>

Atom feed (displays the image properly):

  <entry>
    <title>Digitized 24 hour firmware - Bug #398: Face to face fault-tolerant approach</title>
    <link href="http://localhost:3000/issues/398" rel="alternate"/>
    <id>http://localhost:3000/issues/398?journal_id=132</id>
    <updated>2009-11-11T21:02:26-08:00</updated>
    <author>
      <name>Redmine Admin</name>
      <email>edavis@littlestreamsoftware.com</email>
    </author>
    <content type="html">

&lt;ul&gt;&lt;li&gt;&lt;strong&gt;File&lt;/strong&gt; &lt;a href=&quot;/attachments/5/redmine-error.png&quot;&gt;redmine-error.png&lt;/a&gt; added&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Test &lt;img src=&quot;http://localhost:3000/attachments/download/5&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;    </content>
  </entry>

This might be from Builder. I'm running 2.1.2 which includes this:

Version 2.0.0 introduces automatically escaped attribute values for the first time. Versions prior to 2.0.0 did not insert escape characters into attribute values in the XML markup. This allowed attribute values to explicitly reference entities, which was occasionally used by a small number of developers. Since strings could always be explicitly escaped by hand, this was not a major restriction in functionality.

However, it did suprise most users of builder. Since the body text is normally escaped, everybody expected the attribute values to be escaped as well. Escaped attribute values were the number one support request on the 1.x Builder series.

Starting with Builder version 2.0.0, all attribute values expressed as strings will be processed and the appropriate characters will be escaped (e.g. "&" will be tranlated to "&"). Attribute values that are expressed as Symbol values will not be processed for escaped characters and will be unchanged in output. (Yes, this probably counts as Symbol abuse, but the convention is convenient and flexible).

From: http://builder.rubyforge.org/

Running this by hand, the textilized attributes are escaped:

>> xml = Builder::XmlMarkup.new
=> inspect
>> xml.text! textilizable(change, :notes, :only_path => false)
=> "<inspect/>&lt;p&gt;Test &lt;img src=&quot;http://localhost:3000/attachments/download/5&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;" 

I don't see any specific version of Builder required for Rails, so maybe we are running different versions which is causing the different output. Jean-Philippe, what version of builder do you have?

I'm using builder 2.1.2 too.

Double quotes are not escaped:

irb(main):001:0> require 'rubygems'
=> true
irb(main):002:0> require 'builder'
=> true
irb(main):003:0> xml = Builder::XmlMarkup.new
=> <inspect/>
irb(main):004:0> xml.text! '<img src="foo.png" />'
=> "<inspect/>&lt;img src=\"foo.png\" /&gt;" 

Version:

gem list --local builder

*** LOCAL GEMS ***

builder (2.1.2)