Skip to content

Escape text values in OutputXML - #26

Merged
zhengchun merged 1 commit into
antchfx:masterfrom
MrBeldum:fix/outputxml-escape-text
Oct 7, 2026
Merged

zhengchun merged 1 commit into
antchfx:masterfrom
MrBeldum:fix/outputxml-escape-text

Conversation

@MrBeldum

@MrBeldum MrBeldum commented Oct 5, 2026 •

Copy link
Copy Markdown
Contributor

OutputXML writes JSON string values into the XML as-is. Any value that contains <, > or & therefore produces output that isn't well-formed XML:

doc, _ := jsonquery.Parse(strings.NewReader(`{"a": "AT&T", "b": "<i>"}`))
fmt.Println(doc.OutputXML())
// before: <?xml version="1.0" encoding="utf-8"?><root><a>AT&T</a><b><i></b></root>
// after:  <?xml version="1.0" encoding="utf-8"?><root><a>AT&amp;T</a><b>&lt;i&gt;</b></root>

encoding/xml rejects the old output (XML syntax error ... expected attribute name in element).

Change: text nodes now go through a small strings.Replacer that escapes &, < and >. Element names and InnerText() are not touched.

Test: TestOutputXMLEscapesText compares the exact output and checks that xml.Unmarshal decodes it back to the original strings. The test fails without the change and passes with it. go test ./... passes.

OutputXML wrote JSON string values into the XML verbatim, so a value
containing <, > or & (e.g. "AT&T" or "<i>") produced malformed XML that
no XML parser could read back. Escape those characters in text nodes.
@zhengchun
zhengchun merged commit ffaee79 into antchfx:master Oct 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants