HTML-Escaping in PDFReport
In the file validator/src/main/java/org/mustangproject/validator/PDFValidator.java, the pdfReport content should be properly XML-escaped before being added to the XML output.
Currently, validation messages may contain special characters such as &, <, >, ", or '. These characters can break the generated XML structure because they are inserted without escaping.
Example:
A & B GmbH results in an invalid XML document because & is not escaped.
The pdfReport should therefore be escaped using a proper XML escaping mechanism (e.g. StringEscapeUtils.escapeXml11(...) or equivalent) before being written into the XML node.
0 条评论