paulk-asert opened a new pull request, #2863: URL: https://github.com/apache/groovy/pull/2863
… would break out AbstractStreamingBuilder defines checkCommentText and checkProcessingInstruction, and StreamingMarkupBuilder and StreamingDOMBuilder both call them. StreamingSAXBuilder called neither, passing comment bodies and processing-instruction targets and data straight to the ContentHandler. Neither context supports escaping, so content carrying "-->" or "?>" closes the construct early and whatever follows is emitted as markup. The two validators are now called here as well. The map-valued form of mkp.pi was already covered, because it is assembled by toMapStringClosure, which rejects "?>" in the names and values it writes; the gaps were the comment body, the instruction target, and the non-map instruction data. Comment text is checked before the handler type is consulted. A handler that is not a LexicalHandler discards comments entirely, and silently discarding malformed content is worse than reporting it. This rejects input that was previously accepted, but it was never well-formed XML: the specification forbids "--" within a comment, a comment ending in "-", and "?>" within a processing instruction. A ContentHandler need not serialise, so the check is stricter than a non-serialising sink requires; StreamingDOMBuilder, which builds a DOM rather than text, already rejects on the same grounds. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
