Index: openacs-4/packages/acs-tcl/tcl/test/html-conversion-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/test/html-conversion-procs.tcl,v
diff -u -r1.20.2.14 -r1.20.2.15
--- openacs-4/packages/acs-tcl/tcl/test/html-conversion-procs.tcl	29 Aug 2022 11:53:56 -0000	1.20.2.14
+++ openacs-4/packages/acs-tcl/tcl/test/html-conversion-procs.tcl	27 Aug 2024 08:49:19 -0000	1.20.2.15
@@ -132,14 +132,18 @@
     ad_html_security_check_forbidden_protolcols {
         Tests is href contains allowed protocols
 } {
-    set html "<a href='foo://www.example/com'>An Link</a>"
+    set html {<a href='foo://www.example/com'>An Link</a>}
     aa_true "protocol 'foo' is not allowed" {[ad_html_security_check $html] ne ""}
-    set html "<a href='javascript:alert('hi')'>An Link</a>"
+    set html {<a href='javascript:alert("hi")'>An Link</a>}
     aa_true "protocol 'javascript' is not allowed" {[ad_html_security_check $html] ne ""}
-    set html "<a href='data:alert('hi')'>An Link</a>"
+    set html {<a href='javascript:alert(&quot;hi&quot;)'>An Link</a>}
+    aa_true "protocol 'javascript' is not allowed" {[ad_html_security_check $html] ne ""}
+    set html {<a href='data:alert("hi")'>An Link</a>}
     aa_true "protocol 'data' is not allowed" {[ad_html_security_check $html] ne ""}
-    set html "<a href='blob:https://example.com/')'>An Link</a>"
+    set html {<a href="blob:https://example.com/')">An Link</a>}
     aa_true "protocol 'blob' is not allowed" {[ad_html_security_check $html] ne ""}
+    set html "<a href='blob:https://example.com/&quot;)'>An Link</a>"
+    aa_true "protocol 'blob' is not allowed" {[ad_html_security_check $html] ne ""}
 }
 
 aa_register_case \