[I] XMLEncode: illegal XML control characters not encoded [maven-shared-utils]

["elharo (via GitHub)" <gi...@apache.org>]

elharo opened a new issue, #390:
URL: https://github.com/apache/maven-shared-utils/issues/390

   `XMLEncode.xmlEncodeTextAsPCDATA()` passes characters in the range U+0000-U+001F (excluding U+0009 TAB, U+000A LF, U+000D CR) through unencoded in the `default` branch of its switch statement. These characters are illegal in XML 1.0 and will cause XML parsers to reject the output.
   
   The `default` case at line 112 just does `n.append(c)` — it should instead encode these characters as `&#xHH;` numeric character references. The explicitly handled cases (`&`, `<`, `>`, `"`, `'`, `\r`, `\n`) cover the legal control chars, but `\0`, `\1`-`\b`, `\v`, `\f`, `\u000E`-`\u001F` all slip through.
   
   This affects both attribute values (via `PrettyPrintXMLWriter.addAttribute()`) and text content (via `PrettyPrintXMLWriter.writeText()`).
   
   Fix: add a check in the `default` case to encode illegal XML control characters.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] XMLEncode: illegal XML control characters not encoded [maven-shared-utils]

["slachiewicz (via GitHub)" <gi...@apache.org>]

slachiewicz commented on issue #390:
URL: https://github.com/apache/maven-shared-utils/issues/390#issuecomment-5631310091

   Direction: the fix is #391, which rejects the characters instead of encoding them, since a numeric reference for U+0001 is not valid XML 1.0 either. It is held on one gap: text longer than 12 characters without `]]>` takes the CDATA branch in `xmlEncodeText` before the new check runs, so the control character still reaches the output. Once that check moves ahead of the CDATA branch the PR is mergeable; the exception type (`IOException` versus `IllegalArgumentException`) is the only open question left there.
   
   *This comment was created with AI assistance.*
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org