(maven-doxia) branch master updated: [DOXIA-726] Incorrect escaping of <,>,",' and & (#196)

[kw...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

kwin pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/maven-doxia.git


The following commit(s) were added to refs/heads/master by this push:
     new fcfd42f0 [DOXIA-726] Incorrect escaping of <,>,",' and & (#196)
fcfd42f0 is described below

commit fcfd42f0f014ce43d577e19643c2e4383035a072
Author: Konrad Windszus <kw...@apache.org>
AuthorDate: Wed Jan 17 10:06:59 2024 +0100

    [DOXIA-726] Incorrect escaping of <,>,",' and & (#196)
    
    Use XML entities prior to escaping for Markdown with a backslash
---
 .../java/org/apache/maven/doxia/module/markdown/MarkdownSink.java | 8 +++++---
 .../org/apache/maven/doxia/module/markdown/MarkdownSinkTest.java  | 8 +++++++-
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/doxia-modules/doxia-module-markdown/src/main/java/org/apache/maven/doxia/module/markdown/MarkdownSink.java b/doxia-modules/doxia-module-markdown/src/main/java/org/apache/maven/doxia/module/markdown/MarkdownSink.java
index b9b09089..6977b72b 100644
--- a/doxia-modules/doxia-module-markdown/src/main/java/org/apache/maven/doxia/module/markdown/MarkdownSink.java
+++ b/doxia-modules/doxia-module-markdown/src/main/java/org/apache/maven/doxia/module/markdown/MarkdownSink.java
@@ -33,6 +33,7 @@ import org.apache.maven.doxia.sink.Sink;
 import org.apache.maven.doxia.sink.SinkEventAttributes;
 import org.apache.maven.doxia.sink.impl.AbstractTextSink;
 import org.apache.maven.doxia.sink.impl.SinkEventAttributeSet;
+import org.apache.maven.doxia.util.HtmlTools;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -760,7 +761,7 @@ public class MarkdownSink extends AbstractTextSink implements MarkdownMarkup {
     /**
      * {@inheritDoc}
      *
-     * Unkown events just log a warning message but are ignored otherwise.
+     * Unknown events just log a warning message but are ignored otherwise.
      * @see org.apache.maven.doxia.sink.Sink#unknown(String,Object[],SinkEventAttributes)
      */
     @Override
@@ -819,7 +820,8 @@ public class MarkdownSink extends AbstractTextSink implements MarkdownMarkup {
     // ----------------------------------------------------------------------
 
     /**
-     * Escape special characters in a text in Markdown:
+     * First use XML escaping (leveraging the predefined entities, for browsers)
+     * afterwards escape special characters in a text with a leading backslash (for markdown parsers)
      *
      * <pre>
      * \, `, *, _, {, }, [, ], (, ), #, +, -, ., !
@@ -833,7 +835,7 @@ public class MarkdownSink extends AbstractTextSink implements MarkdownMarkup {
         if (text == null) {
             return "";
         }
-
+        text = HtmlTools.escapeHTML(text, true); // assume UTF-8 output, i.e. only use the mandatory XML entities
         int length = text.length();
         StringBuilder buffer = new StringBuilder(length);
 
diff --git a/doxia-modules/doxia-module-markdown/src/test/java/org/apache/maven/doxia/module/markdown/MarkdownSinkTest.java b/doxia-modules/doxia-module-markdown/src/test/java/org/apache/maven/doxia/module/markdown/MarkdownSinkTest.java
index 1a3b38f8..b32d33e3 100644
--- a/doxia-modules/doxia-module-markdown/src/test/java/org/apache/maven/doxia/module/markdown/MarkdownSinkTest.java
+++ b/doxia-modules/doxia-module-markdown/src/test/java/org/apache/maven/doxia/module/markdown/MarkdownSinkTest.java
@@ -32,6 +32,7 @@ import org.apache.maven.doxia.parser.Parser;
 import org.apache.maven.doxia.sink.Sink;
 import org.apache.maven.doxia.sink.impl.AbstractSinkTest;
 import org.apache.maven.doxia.sink.impl.SinkEventTestingSink;
+import org.apache.maven.doxia.util.HtmlTools;
 import org.hamcrest.MatcherAssert;
 import org.hamcrest.Matchers;
 import org.junit.jupiter.api.Test;
@@ -315,7 +316,11 @@ public class MarkdownSinkTest extends AbstractSinkTest {
 
     /** {@inheritDoc} */
     protected String getTextBlock(String text) {
-        return getEscapedText(text);
+        // this is only called once, therefore hard-code the expected result
+        // return escaped format of "~,_=,_-,_+,_*,_[,_],_<,_>,_{,_},_\\";
+        // i.e. XML entities for <>&"' and Markdown escape sequences for characters outlined in
+        // https://daringfireball.net/projects/markdown/syntax#backslash
+        return "~,\\_=,\\_\\-,\\_\\+,\\_\\*,\\_\\[,\\_\\],\\_&lt;,\\_&gt;,\\_\\{,\\_\\},\\_\\\\";
     }
 
     /** {@inheritDoc} */
@@ -329,6 +334,7 @@ public class MarkdownSinkTest extends AbstractSinkTest {
      * @return the text with all special characters escaped
      */
     private String getEscapedText(String text) {
+        text = HtmlTools.escapeHTML(text, true);
         return text.replaceAll("\\\\|\\`|\\*|_|\\{|\\}|\\[|\\]|\\(|\\)|#|\\+|\\-|\\.|\\!", "\\\\$0");
     }