Escape special characters when working with OME-XML files

Reported here: http://www.openmicroscopy.org/community/viewtopic.php?f=13&t=1455&sid=8f0ee51d27038d6a3d955fa590abd055
melissalinkert · Sep 11, 2012 · 09bc383 · 09bc383
1 parent c16261d
commit 09bc383
Show file tree

Hide file tree

Showing 3 changed files with 37 additions and 7 deletions.
diff --git a/components/common/src/loci/common/xml/XMLTools.java b/components/common/src/loci/common/xml/XMLTools.java
@@ -194,6 +194,36 @@ public static String sanitizeXML(String s) {
     return new String(c);
   }
 
+  /** Escape special characters. */
+  public static String escapeXML(String s) {
+    StringBuffer sb = new StringBuffer();
+
+    for (int i=0; i<s.length(); i++) {
+      char c = s.charAt(i);
+
+      if (c == '<') {
+        sb.append("&lt;");
+      }
+      else if (c == '>') {
+        sb.append("&gt;");
+      }
+      else if (c == '&') {
+        sb.append("&amp;");
+      }
+      else if (c == '\"') {
+        sb.append("&quot;");
+      }
+      else if (c == '\'') {
+        sb.append("&apos;");
+      }
+      else {
+        sb.append(c);
+      }
+    }
+
+    return sb.toString();
+  }
+
   /** Indents XML to be more readable. */
   public static String indentXML(String xml) {
     return indentXML(xml, 3, false);

diff --git a/components/scifio/src/loci/formats/in/OMEXMLReader.java b/components/scifio/src/loci/formats/in/OMEXMLReader.java
@@ -358,8 +358,8 @@ public void startElement(String ur, String localName, String qName,
         xmlBuffer.append("<");
         xmlBuffer.append(qName);
         for (int i=0; i<attributes.getLength(); i++) {
-          String key = attributes.getQName(i);
-          String value = attributes.getValue(i);
+          String key = XMLTools.escapeXML(attributes.getQName(i));
+          String value = XMLTools.escapeXML(attributes.getValue(i));
           if (key.equals("BigEndian")) {
             String endian = value.toLowerCase();
             if (!endian.equals("true") && !endian.equals("false")) {
@@ -387,8 +387,8 @@ public void startElement(String ur, String localName, String qName,
         xmlBuffer.append("<");
         xmlBuffer.append(qName);
         for (int i=0; i<attributes.getLength(); i++) {
-          String key = attributes.getQName(i);
-          String value = attributes.getValue(i);
+          String key = XMLTools.escapeXML(attributes.getQName(i));
+          String value = XMLTools.escapeXML(attributes.getValue(i));
           if (key.equals("Length")) value = "0";
           xmlBuffer.append(" ");
           xmlBuffer.append(key);

diff --git a/components/scifio/src/loci/formats/out/OMEXMLWriter.java b/components/scifio/src/loci/formats/out/OMEXMLWriter.java
@@ -237,12 +237,12 @@ public void startElement(String uri, String localName, String qName,
       Attributes attributes)
     {
       StringBuffer toAppend = new StringBuffer("\n<");
-      toAppend.append(qName);
+      toAppend.append(XMLTools.escapeXML(qName));
       for (int i=0; i<attributes.getLength(); i++) {
         toAppend.append(" ");
-        toAppend.append(attributes.getQName(i));
+        toAppend.append(XMLTools.escapeXML(attributes.getQName(i)));
         toAppend.append("=\"");
-        toAppend.append(attributes.getValue(i));
+        toAppend.append(XMLTools.escapeXML(attributes.getValue(i)));
         toAppend.append("\"");
       }
       toAppend.append(">");