Copilot commented on code in PR #2626:
URL: https://github.com/apache/groovy/pull/2626#discussion_r3471425850
##########
subprojects/groovy-xml/src/main/groovy/groovy/xml/streamingmarkupsupport/AbstractStreamingBuilder.groovy:
##########
@@ -77,6 +77,9 @@ class AbstractStreamingBuilder {
def toMapStringClosure = { Map instruction, checkDoubleQuotationMarks={
value -> !value.toString().contains('"') } ->
def buf = new StringBuilder()
instruction.each { name, value ->
+ if (name.toString().contains('?>') ||
value.toString().contains('?>')) {
+ throw new GroovyRuntimeException("Processing instruction data
must not contain '?>': ${name}=${value}")
+ }
if (checkDoubleQuotationMarks(value)) {
Review Comment:
`toMapStringClosure` now calls `name.toString()` / `value.toString()` as
part of the `?>` validation. If a caller supplies a map with a null key (or
null value), this will throw a `NullPointerException` rather than the intended
`GroovyRuntimeException` with a clear message. Consider coercing via
`String.valueOf(...)` (or Groovy string interpolation) once and validating
those strings.
##########
subprojects/groovy-xml/src/main/groovy/groovy/xml/streamingmarkupsupport/AbstractStreamingBuilder.groovy:
##########
@@ -86,6 +89,32 @@ class AbstractStreamingBuilder {
buf.toString()
}
+ /**
+ * Rejects a processing-instruction target or data fragment that would
prematurely
+ * close the PI. The {@code ?>} sequence ends a PI and cannot be
entity-escaped, so
+ * content holding it would inject sibling markup; such content is
rejected instead.
+ */
+ def checkProcessingInstruction = { part ->
+ if (part?.toString()?.contains('?>')) {
+ throw new GroovyRuntimeException("Processing instruction data must
not contain '?>': ${part}")
+ }
+ part
+ }
Review Comment:
`checkProcessingInstruction` is used for both the PI target and data, but
the exception message says "data" only. Tweaking the wording would make
failures easier to understand when the target itself contains the forbidden
sequence.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
