diff options
| author | Richard Hughes <richard@hughsie.com> | 2018-01-30 23:03:59 +0000 |
|---|---|---|
| committer | Richard Hughes <richard@hughsie.com> | 2018-01-30 23:03:59 +0000 |
| commit | 6048520484101df5d33f3c852c10640e630d20cf (patch) | |
| tree | 37fb32e1521d44f7c9a3c308630b63357077b856 | |
| parent | bdcec1ecee0549e404fdf40dc4529b4380ef87ea (diff) | |
| download | appstream-glib-6048520484101df5d33f3c852c10640e630d20cf.tar.gz | |
Never include '&' in attribute values
Fixes: https://github.com/hughsie/lvfs-website/issues/33
| -rw-r--r-- | libappstream-glib/as-node.c | 7 | ||||
| -rw-r--r-- | libappstream-glib/as-self-test.c | 6 |
2 files changed, 9 insertions, 4 deletions
diff --git a/libappstream-glib/as-node.c b/libappstream-glib/as-node.c index f8199a9..945c465 100644 --- a/libappstream-glib/as-node.c +++ b/libappstream-glib/as-node.c @@ -327,12 +327,17 @@ as_node_get_attr_string (AsNodeData *data) str = g_string_new (""); for (l = data->attrs; l != NULL; l = l->next) { + g_autoptr(GString) value_safe = NULL; attr = l->data; if (g_strcmp0 (attr->key, "@comment") == 0 || g_strcmp0 (attr->key, "@comment-tmp") == 0) continue; + value_safe = g_string_new (attr->value); + as_utils_string_replace (value_safe, "&", "&"); + as_utils_string_replace (value_safe, "<", "<"); + as_utils_string_replace (value_safe, ">", ">"); g_string_append_printf (str, " %s=\"%s\"", - attr->key, attr->value); + attr->key, value_safe->str); } return g_string_free (str, FALSE); } diff --git a/libappstream-glib/as-self-test.c b/libappstream-glib/as-self-test.c index 9800c03..fb4ccf8 100644 --- a/libappstream-glib/as-self-test.c +++ b/libappstream-glib/as-self-test.c @@ -1047,7 +1047,7 @@ as_test_checksum_func (void) AsNode *n; AsNode *root; GString *xml; - const gchar *src = "<checksum type=\"sha1\" filename=\"fn.cab\" target=\"container\">12345</checksum>"; + const gchar *src = "<checksum type=\"sha1\" filename=\"f&n.cab\" target=\"container\">12&45</checksum>"; gboolean ret; g_autoptr(AsNodeContext) ctx = NULL; g_autoptr(AsChecksum) csum = NULL; @@ -1077,8 +1077,8 @@ as_test_checksum_func (void) /* verify */ g_assert_cmpint (as_checksum_get_kind (csum), ==, G_CHECKSUM_SHA1); g_assert_cmpint (as_checksum_get_target (csum), ==, AS_CHECKSUM_TARGET_CONTAINER); - g_assert_cmpstr (as_checksum_get_filename (csum), ==, "fn.cab"); - g_assert_cmpstr (as_checksum_get_value (csum), ==, "12345"); + g_assert_cmpstr (as_checksum_get_filename (csum), ==, "f&n.cab"); + g_assert_cmpstr (as_checksum_get_value (csum), ==, "12&45"); /* back to node */ root = as_node_new (); |