search

martinroob / ngx-i18nsupport

Some tooling to be used for Angular i18n workflows
MIT License
283 stars 69 forks source link

'>' are not escaped by the XmlSerializer #165

Open sbaramov opened 4 years ago

sbaramov commented 4 years ago

Currently the XmlSerializer does not escapes the '>' characters so a string like this: <x id="START_ITALIC_TEXT" ctype="x-i" equiv-text="&lt;i&gt;"/> becomes <x id="START_ITALIC_TEXT" ctype="x-i" equiv-text="&lt;i>"/>

This could easily be fixed by changing line 164 and 168 to include the '>' character

this: return buf.push(' ', attrNode.name, '="', attrNode.value.replace(/[<&"]/g, this._xmlEncoder), '"'); becomes: return buf.push(' ', attrNode.name, '="', attrNode.value.replace(/[<>&"]/g, this._xmlEncoder), '"');

same with line 168: return buf.push(textNode.data.replace(/[<&]/g, this._xmlEncoder)); becomes: return buf.push(textNode.data.replace(/[<>&]/g, this._xmlEncoder));

Since the change is so small did not feel like creating a pull request. However if you prefer a pull request I will be glad to create one

terencehonles commented 3 years ago

It looks like this is not an oversight (and what I figured might be the case), but it looks like ">" "may" be escaped https://www.w3.org/TR/xml/#NT-AttValue