fix: XML-encode a value before inserting it into DOM

oat-sa · Jul 16, 2021 · c4665e9 · c4665e9
1 parent 2b6f67c
commit c4665e9
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 2 deletions.
diff --git a/src/qtism/data/storage/xml/Utils.php b/src/qtism/data/storage/xml/Utils.php
@@ -297,7 +297,8 @@ public static function getDOMElementAttributeAs(DOMElement $element, string $att
                 return $attr === 'true';
         }
 
-        if (in_array(Enumeration::class, class_implements($datatype), true)){
+        if (in_array(Enumeration::class, class_implements($datatype), true)) {
+            /** @var Enumeration $datatype */
             if ($attr !== null) {
                 $constant = $datatype::getConstantByName($attr);
                 // Returns the original value when it's unknown in the enumeration.
@@ -349,7 +350,7 @@ public static function valueAsString($value)
         if (is_bool($value)) {
             return $value === true ? 'true' : 'false';
         }
-        return (string)$value;
+        return htmlspecialchars($value, ENT_XML1);
     }
 
     /**

diff --git a/test/qtismtest/data/storage/xml/marshalling/TemplateDeclarationMarshallerTest.php b/test/qtismtest/data/storage/xml/marshalling/TemplateDeclarationMarshallerTest.php
@@ -3,6 +3,7 @@
 namespace qtismtest\data\storage\xml\marshalling;
 
 use DOMDocument;
+use qtism\common\collections\AbstractCollection;
 use qtism\common\enums\BaseType;
 use qtism\common\enums\Cardinality;
 use qtism\data\state\DefaultValue;
@@ -48,6 +49,37 @@ public function testUnmarshall21()
         $this::assertEquals('tplx', $values[0]->getValue());
     }
 
+    public function testMarshallHtmlEntities21()
+    {
+        $values = new ValueCollection([new Value('non&nbsp;breaking&nbsp;space', BaseType::STRING)]);
+        $defaultValue = new DefaultValue($values);
+        $templateDeclaration = new TemplateDeclaration('tpl1', BaseType::STRING, Cardinality::SINGLE, $defaultValue);
+        $element = $this->getMarshallerFactory('2.1.0')->createMarshaller($templateDeclaration)->marshall($templateDeclaration);
+
+        $dom = new DOMDocument('1.0', 'UTF-8');
+        $element = $dom->importNode($element, true);
+        $this::assertEquals('<templateDeclaration identifier="tpl1" cardinality="single" baseType="string"><defaultValue><value>non&amp;nbsp;breaking&amp;nbsp;space</value></defaultValue></templateDeclaration>', $dom->saveXML($element));
+    }
+
+    public function testUnmarshallHtmlEntities21()
+    {
+        $element = $this->createDOMElement('
+	        <templateDeclaration identifier="tpl1" cardinality="single" baseType="string"><defaultValue><value>non&amp;nbsp;breaking&amp;nbsp;space</value></defaultValue></templateDeclaration>
+	    ');
+
+        $component = $this->getMarshallerFactory('2.1.0')->createMarshaller($element)->unmarshall($element);
+        $this::assertInstanceOf(TemplateDeclaration::class, $component);
+        $this::assertEquals('tpl1', $component->getIdentifier());
+        $this::assertEquals(Cardinality::SINGLE, $component->getCardinality());
+        $this::assertEquals(BaseType::STRING, $component->getBaseType());
+
+        $default = $component->getDefaultValue();
+        $this::assertInstanceOf(DefaultValue::class, $default);
+        $values = $default->getValues();
+        $this::assertCount(1, $values);
+        $this::assertEquals('non&nbsp;breaking&nbsp;space', $values[0]->getValue());
+    }
+
     public function testMarshall20()
     {
         // Make sure that paramVariable and mathVariable appear in output even