[
https://issues.apache.org/jira/browse/GROOVY-12338?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110687#comment-18110687
]
ASF GitHub Bot commented on GROOVY-12338:
-----------------------------------------
paulk-asert opened a new pull request, #2863:
URL: https://github.com/apache/groovy/pull/2863
… would break out
AbstractStreamingBuilder defines checkCommentText and
checkProcessingInstruction, and StreamingMarkupBuilder and StreamingDOMBuilder
both call them. StreamingSAXBuilder called neither, passing comment bodies and
processing-instruction targets and data straight to the ContentHandler. Neither
context supports escaping, so content carrying "-->" or "?>" closes the
construct early and whatever follows is emitted as markup.
The two validators are now called here as well. The map-valued form of
mkp.pi was already covered, because it is assembled by toMapStringClosure,
which rejects "?>" in the names and values it writes; the gaps were the comment
body, the instruction target, and the non-map instruction data.
Comment text is checked before the handler type is consulted. A handler that
is not a LexicalHandler discards comments entirely, and silently discarding
malformed content is worse than reporting it.
This rejects input that was previously accepted, but it was never
well-formed XML: the specification forbids "--" within a comment, a comment
ending in "-", and "?>" within a processing instruction. A ContentHandler need
not serialise, so the check is stricter than a non-serialising sink requires;
StreamingDOMBuilder, which builds a DOM rather than text, already rejects on
the same grounds.
> harden StreamingSAXBuilder comment/PI breakout validation
> ---------------------------------------------------------
>
> Key: GROOVY-12338
> URL: https://issues.apache.org/jira/browse/GROOVY-12338
> Project: Groovy
> Issue Type: Improvement
> Reporter: Paul King
> Assignee: Paul King
> Priority: Major
> Labels: breaking
>
> Input like "--" within a comment was previously accepted, though produced
> invalid XML if serialized. It now throws GroovyRuntimeException.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
