playframework/playframework — pull request #2269 by adamhooper (2014-01-14 20:21:34+00:00)
Title: Escape control chars in XmlFormat

With an XML template like this:

@(s: String)

@s

And `s="\f"`, the result is invalid XML. It will break XML parsers.

The funny thing is, there's no way to encode \f. Control characters simply are not allowed in XML 1.0, in any form -- there are no entities or escape sequences, and CDATA won't help. See http://www.w3.org/TR/xml11/#NT-Char

(The rules are a bit different in XML 1.1, but nobody uses that ;).)

Play's XmlFormat, which is meant to escape invalid XML characters, should not output invalid XML characters. As a template author I expect to produce valid XML without complicated code or external dependencies, regardless of my users' garbage input.

A splendid encoder sits at https://code.google.com/p/owasp-java-encoder/source/browse/trunk/core/src/main/java/org/owasp/encoder/XMLEncoder.java . Please excuse the extra dependency.