openSUSE / docserv

A server for building and publishing documentation with DAPS
https://opensuse.github.io/docserv/
GNU General Public License v3.0
4 stars 3 forks source link

Validate/escape XSLT params and XSLT param files #214

Open ghost opened 5 years ago

ghost commented 5 years ago

Currently, our XSLT parameter functionality will do a nosedive when using either " or ' within values (or parameters). This affects both parameters set via the target default parameter file set in the INI and parameters set via the XML product config.

There is also absolutely no validation of the default target default parameter file. Even just checking that it is of the form x='y' would be good.

It's actually even worse than this, we also fail on ! characters for example.