From 3bb091e26d71c10179c2b40f122dd862c843e9a5 Mon Sep 17 00:00:00 2001
From: Andreas Dangel <andreas.dangel@pmd-code.org>
Date: Sun, 5 Jul 2020 11:19:54 +0200
Subject: [PATCH] [core] CPD: Also escape filename, explicitly set XML 1.0

---
 .../java/net/sourceforge/pmd/cpd/XMLRenderer.java |  4 +++-
 .../net/sourceforge/pmd/cpd/XMLRendererTest.java  | 15 ++++++++++-----
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/pmd-core/src/main/java/net/sourceforge/pmd/cpd/XMLRenderer.java b/pmd-core/src/main/java/net/sourceforge/pmd/cpd/XMLRenderer.java
index 5390e9410f..3cb2ead41b 100644
--- a/pmd-core/src/main/java/net/sourceforge/pmd/cpd/XMLRenderer.java
+++ b/pmd-core/src/main/java/net/sourceforge/pmd/cpd/XMLRenderer.java
@@ -77,6 +77,7 @@ public final class XMLRenderer implements Renderer, CPDRenderer {
         try {
             TransformerFactory tf = TransformerFactory.newInstance();
             Transformer transformer = tf.newTransformer();
+            transformer.setOutputProperty(OutputKeys.VERSION, "1.0");
             transformer.setOutputProperty(OutputKeys.METHOD, "xml");
             transformer.setOutputProperty(OutputKeys.ENCODING, encoding);
             transformer.setOutputProperty(OutputKeys.INDENT, "yes");
@@ -120,7 +121,8 @@ public final class XMLRenderer implements Renderer, CPDRenderer {
             mark = iterator.next();
             final Element file = doc.createElement("file");
             file.setAttribute("line", String.valueOf(mark.getBeginLine()));
-            file.setAttribute("path", mark.getFilename());
+            String filenameXml10 = StringEscapeUtils.unescapeXml(StringEscapeUtils.escapeXml10(mark.getFilename()));
+            file.setAttribute("path", filenameXml10);
             file.setAttribute("endline", String.valueOf(mark.getEndLine()));
             final int beginCol = mark.getBeginColumn();
             final int endCol = mark.getEndColumn();
diff --git a/pmd-core/src/test/java/net/sourceforge/pmd/cpd/XMLRendererTest.java b/pmd-core/src/test/java/net/sourceforge/pmd/cpd/XMLRendererTest.java
index a7ddbb5474..d5340d2c67 100644
--- a/pmd-core/src/test/java/net/sourceforge/pmd/cpd/XMLRendererTest.java
+++ b/pmd-core/src/test/java/net/sourceforge/pmd/cpd/XMLRendererTest.java
@@ -31,6 +31,9 @@ import net.sourceforge.pmd.cpd.renderer.CPDRenderer;
 public class XMLRendererTest {
 
     private static final String ENCODING = (String) System.getProperties().get("file.encoding");
+    private static final String FORM_FEED = "\u000C"; // this character is invalid in XML 1.0 documents
+    private static final String FORM_FEED_ENTITY = "&#12;"; // this is also not allowed in XML 1.0 documents
+
 
     @Test
     public void testWithNoDuplication() throws IOException {
@@ -186,8 +189,8 @@ public class XMLRendererTest {
         CPDRenderer renderer = new XMLRenderer();
         List<Match> list = new ArrayList<>();
         final String espaceChar = "&lt;";
-        Mark mark1 = createMark("public", "/var/F" + '<' + "oo.java", 48, 6, "code fragment");
-        Mark mark2 = createMark("void", "/var/F<oo.java", 73, 6, "code fragment");
+        Mark mark1 = createMark("public", "/var/A<oo.java" + FORM_FEED, 48, 6, "code fragment");
+        Mark mark2 = createMark("void", "/var/B<oo.java", 73, 6, "code fragment");
         Match match1 = new Match(75, mark1, mark2);
         list.add(match1);
 
@@ -195,12 +198,13 @@ public class XMLRendererTest {
         renderer.render(list.iterator(), sw);
         String report = sw.toString();
         assertTrue(report.contains(espaceChar));
+        assertFalse(report.contains(FORM_FEED));
+        assertFalse(report.contains(FORM_FEED_ENTITY));
     }
 
     @Test
     public void testRendererXMLEscaping() throws IOException {
-        String formfeed = "\u000C";
-        String codefragment = "code fragment" + formfeed + "\nline2\nline3";
+        String codefragment = "code fragment" + FORM_FEED + "\nline2\nline3";
         CPDRenderer renderer = new XMLRenderer();
         List<Match> list = new ArrayList<>();
         Mark mark1 = createMark("public", "file1", 1, 2, codefragment);
@@ -211,7 +215,8 @@ public class XMLRendererTest {
         StringWriter sw = new StringWriter();
         renderer.render(list.iterator(), sw);
         String report = sw.toString();
-        assertFalse(report.contains(formfeed));
+        assertFalse(report.contains(FORM_FEED));
+        assertFalse(report.contains(FORM_FEED_ENTITY));
     }
 
     private Mark createMark(String image, String tokenSrcID, int beginLine, int lineCount, String code) {