fizzbeom opened a new pull request, #4422: URL: https://github.com/apache/logging-log4j2/pull/4422
`HtmlLayout` escapes all user-controlled fields with `Transform.escapeHtmlTags`, but no test verified this at the layout level. This PR adds one; no production code is changed. The new test logs an event whose thread name, logger name, source file, message, NDC, MDC and exception contain HTML markup, attribute-breaking quotes and a character that is invalid in XML 1.0. It checks that each field is rendered escaped, both in element content and in `title` attributes. I also checked that the test fails when escaping is broken: removing the `<` or `"` escape, removing the invalid XML character replacement, or dropping the escape call for the MDC field. I used an AI assistant (Claude) while writing this test, and reviewed and verified the changes myself. ## Checklist * [x] Base your changes on `2.x` branch if you are targeting Log4j 2; use `main` otherwise * [ ] `./mvnw verify` succeeds: I ran the full `log4j-core-test` module locally on Windows/JDK 17. The only failure, `RollingAppenderCronOnStartupTest` (`MalformedInputException`), also fails on an unmodified `2.x` checkout. * [x] Non-trivial changes contain an entry file in the `src/changelog/.2.x.x` directory (test-only change, no entry added) * [x] Tests are provided -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
