search

tkrajina / gpxpy

gpx-py is a python GPX parser. GPX (GPS eXchange Format) is an XML based file format for GPS tracks.
Apache License 2.0
987 stars 223 forks source link

Custom attributes in `to_xml` not escaped properly #277

Closed ijsf closed 2 weeks ago

ijsf commented 4 months ago

It seems that if to_xml() is called to produce a XML file, certain conditions can cause a XML with invalid syntax to be produced.

This happens whenever there are custom attributes in a waypoint. Even though the regular attributes seem to escape properly (e.g. & to &), this validation doesn't seem to be done for the custom attributes. Here is an example of a failure case:

  <wpt lat="52.4824535" lon="13.4451467">
    <time>2024-02-12T12:48:53Z</time>
    <name>Du Beast drinks &amp; coffee</name>
    <desc>Innstraße 4, Neukölln</desc>
    <sym>amenity_pub</sym>
    <extensions>
      <osmand:amenity_name>Du Beast drinks & coffee</osmand:amenity_name>
      <osmand:amenity_origin>Amenity:Du Beast drinks & coffee: sustenance:bar</osmand:amenity_origin>
    </extensions>
  </wpt>

This is invalid XML cause there is a disallowed ampersand at line 7 (drinks & coffee).

This can easily be reproduced by using a GPX file with custom attributes (e.g. from OSMAnd in this case) that contain any of the special characters that are invalid in XML such as &.

RDMurray commented 3 weeks ago

@tkrajina since this will be a simple fix, should I make a pr to master, or dev?