[jira] [Commented] (GROOVY-12338) harden StreamingSAXBuilder comment/PI breakout validation

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/GROOVY-12338?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110687#comment-18110687 ] 

ASF GitHub Bot commented on GROOVY-12338:
-----------------------------------------

paulk-asert opened a new pull request, #2863:
URL: https://github.com/apache/groovy/pull/2863

   … would break out
   
   AbstractStreamingBuilder defines checkCommentText and checkProcessingInstruction, and StreamingMarkupBuilder and StreamingDOMBuilder both call them. StreamingSAXBuilder called neither, passing comment bodies and processing-instruction targets and data straight to the ContentHandler. Neither context supports escaping, so content carrying "-->" or "?>" closes the construct early and whatever follows is emitted as markup.
   
   The two validators are now called here as well. The map-valued form of mkp.pi was already covered, because it is assembled by toMapStringClosure, which rejects "?>" in the names and values it writes; the gaps were the comment body, the instruction target, and the non-map instruction data.
   
   Comment text is checked before the handler type is consulted. A handler that is not a LexicalHandler discards comments entirely, and silently discarding malformed content is worse than reporting it.
   
   This rejects input that was previously accepted, but it was never well-formed XML: the specification forbids "--" within a comment, a comment ending in "-", and "?>" within a processing instruction. A ContentHandler need not serialise, so the check is stricter than a non-serialising sink requires; StreamingDOMBuilder, which builds a DOM rather than text, already rejects on the same grounds.




> harden StreamingSAXBuilder comment/PI breakout validation
> ---------------------------------------------------------
>
>                 Key: GROOVY-12338
>                 URL: https://issues.apache.org/jira/browse/GROOVY-12338
>             Project: Groovy
>          Issue Type: Improvement
>            Reporter: Paul King
>            Assignee: Paul King
>            Priority: Major
>              Labels: breaking
>
> Input like "--" within a comment was previously accepted, though produced invalid XML if serialized. It now throws GroovyRuntimeException.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)