fix: XML-encode a value before inserting it into DOM

(cherry picked from commit c4665e9)
oat-sa · Jul 16, 2021 · a238ea8 · a238ea8
1 parent 6dbc604
commit a238ea8
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 1 deletion.
diff --git a/qtism/data/storage/xml/Utils.php b/qtism/data/storage/xml/Utils.php
@@ -262,7 +262,7 @@ public static function valueAsString($value)
         if (is_bool($value)) {
             return $value === true ? 'true' : 'false';
         }
-        return (string)$value;
+        return htmlspecialchars($value, ENT_XML1);
     }
 
     /**

diff --git a/test/qtismtest/data/storage/xml/marshalling/TemplateDeclarationMarshallerTest.php b/test/qtismtest/data/storage/xml/marshalling/TemplateDeclarationMarshallerTest.php
@@ -46,4 +46,35 @@ public function testUnmarshall21()
         $this::assertCount(1, $values);
         $this::assertEquals('tplx', $values[0]->getValue());
     }
+
+    public function testMarshallHtmlEntities21()
+    {
+        $values = new ValueCollection([new Value('non&nbsp;breaking&nbsp;space', BaseType::STRING)]);
+        $defaultValue = new DefaultValue($values);
+        $templateDeclaration = new TemplateDeclaration('tpl1', BaseType::STRING, Cardinality::SINGLE, $defaultValue);
+        $element = $this->getMarshallerFactory('2.1.0')->createMarshaller($templateDeclaration)->marshall($templateDeclaration);
+
+        $dom = new DOMDocument('1.0', 'UTF-8');
+        $element = $dom->importNode($element, true);
+        $this::assertEquals('<templateDeclaration identifier="tpl1" cardinality="single" baseType="string"><defaultValue><value>non&amp;nbsp;breaking&amp;nbsp;space</value></defaultValue></templateDeclaration>', $dom->saveXML($element));
+    }
+
+    public function testUnmarshallHtmlEntities21()
+    {
+        $element = $this->createDOMElement('
+	        <templateDeclaration identifier="tpl1" cardinality="single" baseType="string"><defaultValue><value>non&amp;nbsp;breaking&amp;nbsp;space</value></defaultValue></templateDeclaration>
+	    ');
+
+        $component = $this->getMarshallerFactory('2.1.0')->createMarshaller($element)->unmarshall($element);
+        $this::assertInstanceOf(TemplateDeclaration::class, $component);
+        $this::assertEquals('tpl1', $component->getIdentifier());
+        $this::assertEquals(Cardinality::SINGLE, $component->getCardinality());
+        $this::assertEquals(BaseType::STRING, $component->getBaseType());
+
+        $default = $component->getDefaultValue();
+        $this::assertInstanceOf(DefaultValue::class, $default);
+        $values = $default->getValues();
+        $this::assertCount(1, $values);
+        $this::assertEquals('non&nbsp;breaking&nbsp;space', $values[0]->getValue());
+    }
 }