[BUG] xml/html escaping is not powerful enough

[chainsawriot]

mtcars2 <- mtcars

colnames(mtcars2)[1] <- "mp&g"
## fine
rio::export(mtcars2, tempfile(fileext = ".xml"))
#> Loading required namespace: xml2
rio::export(mtcars2, tempfile(fileext = ".html"))


colnames(mtcars2)[1] <- "mp\"g"
## not
rio::export(mtcars2, tempfile(fileext = ".xml"))
#> Error in read_xml.raw(charToRaw(enc2utf8(x)), "UTF-8", ..., as_html = as_html, : error parsing attribute name [68]
rio::export(mtcars2, tempfile(fileext = ".html"))


colnames(mtcars2)[1] <- "mp\'g"
## not
rio::export(mtcars2, tempfile(fileext = ".xml"))
#> Error in read_xml.raw(charToRaw(enc2utf8(x)), "UTF-8", ..., as_html = as_html, : error parsing attribute name [68]
rio::export(mtcars2, tempfile(fileext = ".html"))

colnames(mtcars2)[1] <- "mp>g"
## not
rio::export(mtcars2, tempfile(fileext = ".xml"))
#> Error in read_xml.raw(charToRaw(enc2utf8(x)), "UTF-8", ..., as_html = as_html, : Extra content at the end of the document [5]
rio::export(mtcars2, tempfile(fileext = ".html"))

colnames(mtcars2)[1] <- "mp<g"
## not
rio::export(mtcars2, tempfile(fileext = ".xml"))
#> Error in read_xml.raw(charToRaw(enc2utf8(x)), "UTF-8", ..., as_html = as_html, : error parsing attribute name [68]
rio::export(mtcars2, tempfile(fileext = ".html"))
#> Error in read_xml.raw(charToRaw(enc2utf8(x)), "UTF-8", ..., as_html = as_html, : error parsing attribute name [68]

sessionInfo()
#> R version 4.3.1 (2023-06-16)
#> Platform: x86_64-pc-linux-gnu (64-bit)
#> Running under: Ubuntu 22.04.3 LTS
#> 
#> Matrix products: default
#> BLAS:   /usr/lib/x86_64-linux-gnu/blas/libblas.so.3.10.0 
#> LAPACK: /usr/lib/x86_64-linux-gnu/lapack/liblapack.so.3.10.0
#> 
#> locale:
#>  [1] LC_CTYPE=en_US.UTF-8       LC_NUMERIC=C              
#>  [3] LC_TIME=de_DE.UTF-8        LC_COLLATE=en_US.UTF-8    
#>  [5] LC_MONETARY=de_DE.UTF-8    LC_MESSAGES=en_US.UTF-8   
#>  [7] LC_PAPER=de_DE.UTF-8       LC_NAME=C                 
#>  [9] LC_ADDRESS=C               LC_TELEPHONE=C            
#> [11] LC_MEASUREMENT=de_DE.UTF-8 LC_IDENTIFICATION=C       
#> 
#> time zone: Europe/Berlin
#> tzcode source: system (glibc)
#> 
#> attached base packages:
#> [1] stats     graphics  grDevices utils     datasets  methods   base     
#> 
#> loaded via a namespace (and not attached):
#>  [1] compiler_4.3.1    reprex_2.0.2      Rcpp_1.0.11       zip_2.3.0        
#>  [5] xml2_1.3.5        readxl_1.4.3      yaml_2.3.7        fastmap_1.1.1    
#>  [9] curl_5.0.2        openxlsx_4.2.5.2  knitr_1.43        forcats_1.0.0    
#> [13] tibble_3.2.1      R.cache_0.16.0    pillar_1.9.0      R.utils_2.12.2   
#> [17] rlang_1.1.1       utf8_1.2.3        stringi_1.7.12    xfun_0.40        
#> [21] fs_1.6.3          cli_3.6.1         withr_2.5.0       magrittr_2.0.3   
#> [25] rio_0.5.29        digest_0.6.33     haven_2.5.3       hms_1.1.3        
#> [29] lifecycle_1.0.3   R.methodsS3_1.8.2 R.oo_1.25.0       vctrs_0.6.3      
#> [33] evaluate_0.21     glue_1.6.2        data.table_1.14.8 cellranger_1.1.0 
#> [37] styler_1.10.1     fansi_1.0.4       foreign_0.8-82    rmarkdown_2.24   
#> [41] purrr_1.0.2       tools_4.3.1       pkgconfig_2.0.3   htmltools_0.5.6

^{Created on 2023-08-20 with reprex v2.0.2}

[chainsawriot]

https://github.com/leeper/rio/blob/c17081c6c2892591998f494cc19ee2c2058ebcea/R/export_methods.R#L288-L290

This escaping is not enough.

Consider this:

https://github.com/ropensci/readODS/blob/d27e26191e2ed0d4138dffaf1cfd9a1b55aaf2c9/R/utils.R#L10-L13

[chainsawriot]

stringi is a dependency of openxlsx anyway.