mrichards42 / xword

Cross-platform crossword solving
https://mrichards42.github.io/xword/
GNU General Public License v3.0
42 stars 13 forks source link

Ensure XML characters are escaped when reading PUZ/RGZ. #184

Closed jpd236 closed 2 years ago

jpd236 commented 2 years ago

XWord assumes that metadata and clue strings are valid XML/HTML when rendering. This works fine for JPZ since the input is itself a valid XML file, but may not be the case for other formats.

The clues and notepad were already being escaped when reading PUZ files (and unescaped when writing them); we should do the same for the title, author, and notes. Similarly, when reading RGZ files, we should escape XML for any free-form text.

See #182

mrichards42 commented 2 years ago

Shoot, this feels like a basic problem with Square (expecting all strings to be valid xml/html), since this is an issue with any plain-text format (e.g. across lite txt, the newsday format the importer uses).

I'd almost be inclined to add SetHtmlXXX() functions and change all the regular SetXXX() to escape xml entities . . . or at least expose escape/unescape functions in lua since this is an issue with multiple formats.

mrichards42 commented 2 years ago

I lost track of this one. I'll go ahead and merge since this fixes a problem, but would like to get something in place eventually that handles this for all puzzles.

jpd236 commented 2 years ago

I was planning to go ahead with your suggestion - just haven't had the time to sit down and do it right. But thanks for merging this for now - will plan to send a PR which undoes it and does something along the lines of what you suggested.