Skip to content

]]> minified into invalid XML #825

@bmatthews

Description

@bmatthews

I was running some fuzzing tests in an application where i am using this library and discouvered it created invalid xml when ]]> appeared in the xml. while i escape that to ]]> your library then unescapes it back to ]]>

i added this test which outlines my assumption.

diff --git a/xml/xml_test.go b/xml/xml_test.go
index 03e5779..603b77e 100644
--- a/xml/xml_test.go
+++ b/xml/xml_test.go
@@ -42,6 +42,7 @@ func TestXML(t *testing.T) {
                {"<x>\n<!--y-->\n</x>", `<x></x>`},
                {`<style>lala{color:red}</style>`, `<style>lala{color:red}</style>`},
                {`cats  and     dogs `, `cats and dogs`},
+               {`<x> ]]&gt; </x>`, `<x>]]&gt;</x>`}, // #722
 
                // go fuzz
                {`</0`, `</0`},

Note i worked around this for my use case by calling

delete(xml.EntitiesMap, "gt")

that obviously removes some valid minifications though

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions