Properly escape special characters in XML #77
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 3 commits
September 19, 2018 16:03
When using CDATA, it is unnecessary to escape html characters; however, one thing that must be escaped is the CEnd tag.
|
Hello? |
freekmurze
requested changes
Jan 10, 2019
|
Sorry for the long wait, this PR seems to have slipped through the net. |
|
No problem, it can happen. I will take a look at the changes you requested soon! |
|
It's no problem! |
|
Dear contributor, because this pull request seems to be inactive for quite some time now, I've automatically closed it. If you feel this pull request deserves some attention from my human colleagues feel free to reopen it. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
<![CDATA[]]>sections do not need to have HTML escaped. Doing so causes strange output.For example, if the title of a Feed Item is "I like PB&J", then it would be output as "I like PB&J", which is subsequently what would be shown to the user.
However, what does need to be escaped is the CEnd tag:
]]>. I made a helper function which escapes that so that no user input can cause any harm.I included a test to verify that the output is correct. I wasn't sure the exact way I should go about adding the test, so I created a new
SpecialDummyItemclass which has a title with strange characters.P.S. I also removed a space in the
<author>tag... I couldn't help it.