Skip Menu |

Preferred bug tracker

Please visit the preferred bug tracker to report your issue.

This queue is for tickets about the XML-Quick CPAN distribution.

Report information
The Basics
Id: 108857
Status: resolved
Priority: 0/
Queue: XML-Quick

People
Owner: Nobody in particular
Requestors: peichman [...] cpan.org
Cc:
AdminCc:

Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: (no value)



Subject: Single quotes in attribute values are not escaped
Date: Thu, 12 Nov 2015 19:24:30 -0500
To: bug-XML-Quick [...] rt.cpan.org
From: Peter Eichman <peichman [...] cpan.org>
Attribtue values containing single quotes are not correctly escaped, leading to invalid XML output. Test code: #!/usr/bin/perl -w use strict; use XML::Quick; use Test::More tests => 2; # one single quote is( xml({ foo => { _attrs => { bar => "O'Reilly" }}}), q{<foo bar='O&apos;Reilly'/>}, ); # multiple single quotes is( xml({ foo => { _attrs => { bar => "O'Reilly and O'Toole" }}}), q{<foo bar='O&apos;Reilly and O&apos;Toole'/>}, ); Run against the current 0.05 version of XML::Quick produces the following: 1..2 not ok 1 # Failed test at /home/peter/xml-quick-attr-bug line 7. # got: '<foo bar='O'Reilly'/>' # expected: '<foo bar='O&apos;Reilly'/>' not ok 2 # Failed test at /home/peter/xml-quick-attr-bug line 12. # got: '<foo bar='O'Reilly and O'Toole'/>' # expected: '<foo bar='O&apos;Reilly and O&apos;Toole'/>' # Looks like you failed 2 tests of 2. After applying the attached patch, the test code succeeds. Version info: * XML-Quick-0.05 * perl 5.10.0 * Linux grim 2.6.31-23-generic #75-Ubuntu SMP Fri Mar 18 18:08:39 UTC 2011 i686 GNU/Linux -- peichman@cpan.org http://github.com/peichman

Message body is not shown because sender requested not to inline it.

Wow, what a stupid bug. I spent a while staring at it wondering why the first one didn't get escaped, and finally understood that I wasn't even using the value. If I ever meet 2006 me I'm going to punch him. Thanks so much for the patch and test. I've just pushed 0.06 to CPAN. Cheers, Rob N.