You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Any CR characters in script output are backslash-escaped in XML output, while LFs are not:
<elemkey="output">No LSB modules are available.\x0D
Distributor ID:	Ubuntu\x0D
Description:	Ubuntu 16.04.6 LTS\x0D
Release:	16.04\x0D
Codename:	xenial\x0D
</elem>
The patch below rectifies the issue, treating CRs just like LFs:
<elemkey="output">No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 16.04.6 LTS
Release:	16.04
Codename:	xenial
</elem>
* Prevents backslash-escaping of CR characters in XML output
--- a/output.cc+++ b/output.cc@@ -493,8 +493,21 @@
xml_write_escaped is not enough; some characters are not allowed to appear in
XML, not even escaped. */
std::string protect_xml(const std::string s) {
- /* escape_for_screen is good enough. */- return escape_for_screen(s);+ std::string r;++ for (unsigned int i = 0; i < s.size(); i++) {+ char buf[5];+ unsigned char c = s[i];+ // Printable and some whitespace ok.+ if (c == '\t' || c == '\r' || c == '\n' || (0x20 <= c && c <= 0x7e)) {+ r += c;+ } else {+ Snprintf(buf, sizeof(buf), "\\x%02X", c);+ r += buf;+ }+ }++ return r;
}
/* This is a helper function to determine the ordering of the script results
Activity
nnposter commentedon Jun 30, 2019
The code will be committed on or after July 15 unless concerns are raised.
Prevent backslash-escaping of CR characters in XML output. Fixes nmap…