[maven-doxia-sitetools] 01/02: [DOXIASITETOOLS-299] Site descriptor interpolation does not properly escape reserved XML chars

[mi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

michaelo pushed a commit to branch merge
in repository https://gitbox.apache.org/repos/asf/maven-doxia-sitetools.git

commit 52096255d7738af656728d9a438d2acdc48cedb6
Author: Michael Osipov <mi...@apache.org>
AuthorDate: Wed Mar 29 23:44:54 2023 +0200

    [DOXIASITETOOLS-299] Site descriptor interpolation does not properly escape reserved XML chars
    
    This closes #100
---
 .../apache/maven/doxia/tools/DefaultSiteTool.java    | 17 +++++++++++++++++
 .../org/apache/maven/doxia/tools/SiteToolTest.java   | 20 ++++++++++++++++++--
 .../test/resources/unit/interpolated-site/pom.xml    |  2 +-
 3 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/doxia-integration-tools/src/main/java/org/apache/maven/doxia/tools/DefaultSiteTool.java b/doxia-integration-tools/src/main/java/org/apache/maven/doxia/tools/DefaultSiteTool.java
index a397b15..c4701a7 100644
--- a/doxia-integration-tools/src/main/java/org/apache/maven/doxia/tools/DefaultSiteTool.java
+++ b/doxia-integration-tools/src/main/java/org/apache/maven/doxia/tools/DefaultSiteTool.java
@@ -62,6 +62,7 @@ import org.apache.maven.reporting.MavenReport;
 import org.codehaus.plexus.i18n.I18N;
 import org.codehaus.plexus.interpolation.EnvarBasedValueSource;
 import org.codehaus.plexus.interpolation.InterpolationException;
+import org.codehaus.plexus.interpolation.InterpolationPostProcessor;
 import org.codehaus.plexus.interpolation.MapBasedValueSource;
 import org.codehaus.plexus.interpolation.PrefixedObjectValueSource;
 import org.codehaus.plexus.interpolation.PrefixedPropertiesValueSource;
@@ -444,6 +445,22 @@ public class DefaultSiteTool implements SiteTool {
             }
         }
 
+        interpolator.addPostProcessor(new InterpolationPostProcessor() {
+            @Override
+            public Object execute(String expression, Object value) {
+                if (value != null) {
+                    // we're going to parse this back in as XML so we need to escape XML markup
+                    return value.toString()
+                            .replace("&", "&amp;")
+                            .replace("<", "&lt;")
+                            .replace(">", "&gt;")
+                            .replace("\"", "&quot;")
+                            .replace("'", "&apos;");
+                }
+                return null;
+            }
+        });
+
         try {
             // FIXME: this does not escape xml entities, see MSITE-226, PLXCOMP-118
             return interpolator.interpolate(siteDescriptorContent);
diff --git a/doxia-integration-tools/src/test/java/org/apache/maven/doxia/tools/SiteToolTest.java b/doxia-integration-tools/src/test/java/org/apache/maven/doxia/tools/SiteToolTest.java
index b1cf552..3aa6bc4 100644
--- a/doxia-integration-tools/src/test/java/org/apache/maven/doxia/tools/SiteToolTest.java
+++ b/doxia-integration-tools/src/test/java/org/apache/maven/doxia/tools/SiteToolTest.java
@@ -449,15 +449,31 @@ public class SiteToolTest {
         String siteDescriptorContent = FileUtils.fileRead(descriptorFile);
         assertNotNull(siteDescriptorContent);
         assertTrue(siteDescriptorContent.contains("${project.name}"));
-        assertFalse(siteDescriptorContent.contains("Interpolatesite"));
+        assertFalse(siteDescriptorContent.contains(
+                "Interpolatesite &quot;quoted&quot; &amp; &apos;quoted&apos; &lt;sdf&gt;"));
 
         SiteToolMavenProjectStub project = new SiteToolMavenProjectStub("interpolated-site");
+        List<MavenProject> reactorProjects = Collections.<MavenProject>singletonList(project);
 
         siteDescriptorContent = tool.getInterpolatedSiteDescriptorContent(
                 new HashMap<String, String>(), project, siteDescriptorContent);
         assertNotNull(siteDescriptorContent);
         assertFalse(siteDescriptorContent.contains("${project.name}"));
-        assertTrue(siteDescriptorContent.contains("Interpolatesite"));
+        assertTrue(siteDescriptorContent.contains(
+                "Interpolatesite &quot;quoted&quot; &amp; &apos;quoted&apos; &lt;sdf&gt;"));
+
+        DecorationModel model = tool.getDecorationModel(
+                new File(project.getBasedir(), "src/site"),
+                SiteTool.DEFAULT_LOCALE,
+                project,
+                reactorProjects,
+                newRepoSession(),
+                project.getRemoteProjectRepositories());
+        assertNotNull(model);
+
+        assertEquals(
+                "Test " + project.getName(),
+                model.getBody().getMenus().get(0).getItems().get(1).getName());
     }
 
     // MSHARED-217 -> DOXIATOOLS-34 -> DOXIASITETOOLS-118
diff --git a/doxia-integration-tools/src/test/resources/unit/interpolated-site/pom.xml b/doxia-integration-tools/src/test/resources/unit/interpolated-site/pom.xml
index a135e21..8e6ca96 100644
--- a/doxia-integration-tools/src/test/resources/unit/interpolated-site/pom.xml
+++ b/doxia-integration-tools/src/test/resources/unit/interpolated-site/pom.xml
@@ -27,7 +27,7 @@ under the License.
   <packaging>jar</packaging>
   <version>1.0-SNAPSHOT</version>
   <inceptionYear>2006</inceptionYear>
-  <name>Interpolatesite</name>
+  <name>Interpolatesite "quoted" &amp; 'quoted' &lt;sdf&gt;</name>
   <description>Test interpolation for site.xml.</description>
   <url>http://maven.apache.org</url>
   <dependencies>