0000856: DbExport to XML and SYM_XML do not escape data

JumpMind · Oct 17, 2012 · 9ac6f7e · 9ac6f7e
1 parent 9227d23
commit 9ac6f7e
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/symmetric-client/src/main/java/org/jumpmind/symmetric/DbExport.java b/symmetric-client/src/main/java/org/jumpmind/symmetric/DbExport.java
@@ -32,6 +32,7 @@
 
 import javax.sql.DataSource;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.commons.lang.StringUtils;
 import org.jumpmind.db.io.DatabaseIO;
 import org.jumpmind.db.model.Column;
@@ -238,15 +239,15 @@ public Object mapRow(Row row) {
                     } else if (format == Format.XML){
                         writer.write("\t<row>\n");
                         for (int i = 0; i < columns.length; i++) {
-                            writer.write("\t\t<field name=\"" + columns[i].getName() + "\">" + values[i] + "</field>\n");
+                            writer.write("\t\t<field name=\"" + columns[i].getName() + "\">" + StringEscapeUtils.escapeXml(values[i]) + "</field>\n");
                         }
                         writer.write("\t</row>\n");
 
                     } else if (format == Format.SYM_XML){
                         writer.write("\t<row entity=\"" + tableName + "\" dml=\"I\">\n");
                         for (int i = 0; i < columns.length; i++) {
                             if (values[i] != null) {
-                                writer.write("\t\t<data key=\"" + columns[i].getName() + "\">" + values[i] + "</data>\n");
+                                writer.write("\t\t<data key=\"" + columns[i].getName() + "\">" + StringEscapeUtils.escapeXml(values[i]) + "</data>\n");
                             } else {
                                 writer.write("\t\t<data key=\"" + columns[i].getName() + "\" xsi:nil=\"true\" />\n");
                             }