LitleCo/litle-sdk-for-dotNet — pull request #22 by lmikkelsen (2013-12-13 22:56:46+00:00)
Title: Add test case for invalid XML

The Serialize() methods in XmlRequestFields simply concatenate strings to generate the XML request. Since none of the input is escaped this will cause the XML to be invalid or malformed if the input contains reserved characters (i.e. greater than, less than, ampersand, and percent).

This commit adds a failing test case for input containing an ampersand. The test causes the Litle service to return "Error validating xml data against the schema The entity name must immediately follow the '&' in the entity reference."

One way to fix this issue is to use the XmlSerializer class which generates well-formed XML - as in the unused LitleOnline.SerializeObject() method. However, this will require some refactoring of the existing code. Another approach is to escape all input in the Serialize() methods.