Fix bug 2832322 - cpd.xml file tag path attribute should be entity-encoded.

git-svn-id: https://pmd.svn.sourceforge.net/svnroot/pmd/trunk@6989 51baf565-9d33-0410-a72c-fc3788e3496d

pmd/etc/changelog.txt

@@ -404,6 +404,7 @@ Creating a unnecessary Code Ruleset and moved the following rules from Basic rul
         * UselessParentheses
 	Basic rulesets still includes a reference to those rules.	
 
+Fixed bug 2832322 -  cpd.xml file tag path attribute should be entity-encoded
 Fixed bug 2826119 - False +: DoubleCheckedLocking warning with volatile field
 Fixed bug 2835074 - False -: DoubleCheckedLocking with reversed null check
 Fixed bug 1932242 - EmptyMethodInAbstractClassShouldBeAbstract false +

pmd/regress/test/net/sourceforge/pmd/cpd/XMLRendererTest.java

@@ -4,6 +4,7 @@
 package test.net.sourceforge.pmd.cpd;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 import net.sourceforge.pmd.cpd.Match;
 import net.sourceforge.pmd.cpd.Renderer;
@@ -101,6 +102,18 @@ public class XMLRendererTest {
         }
     }
 
+    @Test
+    public void testRendererEncodedPath() {
+        Renderer renderer = new XMLRenderer();
+        List<Match> list = new ArrayList<Match>();
+        Match match1 = new Match(75, new TokenEntry("public", "/var/F" + XMLRenderer.BASIC_ESCAPE[2][0] + "oo.java", 48), new TokenEntry("void", "/var/F<oo.java", 73));
+        match1.setLineCount(6);
+        match1.setSourceCodeSlice("code fragment");
+        list.add(match1);
+        String report = renderer.render(list.iterator());
+        assertTrue(report.contains(XMLRenderer.BASIC_ESCAPE[2][1]));
+    }
+    
     public static junit.framework.Test suite() {
         return new junit.framework.JUnit4TestAdapter(XMLRendererTest.class);
     }

pmd/src/net/sourceforge/pmd/cpd/XMLRenderer.java

@@ -22,7 +22,11 @@ public class XMLRenderer implements Renderer {
     public XMLRenderer(String e) {
         this.encoding = e;
     }
-	
+    
+	// FUTURE: Use a XML API - rather than StringBuffer to generate XML Report. 
+    // The most convenient would be to use one shipped in the JRE, and this should
+    // also allow us to get ride of the encode below, as the XML API choosed will
+    // do that for us...
     public String render(Iterator<Match> matches) {
         StringBuffer buffer = new StringBuffer(300);
         buffer.append("<?xml version=\"1.0\" encoding=\"");
@@ -44,7 +48,7 @@ public class XMLRenderer implements Renderer {
                 buffer.append("<file line=\"");
                 buffer.append(mark.getBeginLine());
                 buffer.append("\" path=\"");
-                buffer.append(mark.getTokenSrcID());
+                buffer.append(XMLRenderer.encode(mark.getTokenSrcID()));
                 buffer.append("\"/>").append(PMD.EOL);
             }
             String codeFragment = match.getSourceCodeSlice();
@@ -58,4 +62,31 @@ public class XMLRenderer implements Renderer {
         buffer.append("</pmd-cpd>");
         return buffer.toString();
     }
+
+    /*
+    * <p>Fixes bug : https://sourceforge.net/tracker/?func=detail&aid=2832322&group_id=56262&atid=479921</p>
+    * 
+    * TODO: The following method - and its static arrays - should
+    * most likely be place somewhere else, like some kind of utility
+    * classes to solve issue on encoding.
+	*/
+	private static String encode(String path) {
+		for ( int i = 0; i < BASIC_ESCAPE.length; i++ ) {
+			if ( path.indexOf(BASIC_ESCAPE[i][0]) != -1 ) {
+				path = path.replaceAll(BASIC_ESCAPE[i][0],BASIC_ESCAPE[i][1]);
+			}
+		}
+		return path;
+	}
+	
+	/* 
+	 * Cut'n'paster from Apache Commons Lang
+	 * 
+	 */
+	public static final String[][] BASIC_ESCAPE = {
+        {"\"", "&quot;"}, // " - double-quote
+        {"&", "&amp;"},   // & - ampersand
+        {"<", "&lt;"},    // < - less-than
+        {">", "&gt;"},    // > - greater-than
+    };
 }