DO NOT REPLY [Bug 8397] New: - SimpleXmlRpcClient does not properly encode character data

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=8397>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=8397

SimpleXmlRpcClient does not properly encode character data

           Summary: SimpleXmlRpcClient does not properly encode character
                    data
           Product: XML-RPC
           Version: unspecified
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: Source
        AssignedTo: rpc-dev@xml.apache.org
        ReportedBy: odela01@ca.com


All string values passed via XML-RPC should be entity encoded. That is, < encoded as &lt; etc. In XML-RPC 1.1 (and CVS last time I checked), the XmlWriter class in src/java/org/apache/xmlrpc/applet/SimpleXmlRpcClient.java will write strings into the XML document without any encoding. This means that strings containing <, > and & characters are not passed properly.

The easiest fix seems to be the following (against revision 1.1):

--- SimpleXmlRpcClient.java     Tue Apr 23 14:36:52 2002
+++ SimpleXmlRpcClient.java.orig        Tue Apr 23 14:30:56 2002
@@ -635,12 +635,12 @@
 
         public void write (char[] text)
         {
-            chardata(new String(text));
+            buf.append (text);
         }
 
         public void write (String text)
         {
-            chardata(text);
+            buf.append (text);
         }
 
         public String toString ()