implement tx api xml adaptor #27
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return str | ||
| .replace(/&/g, '&') |
Check failure
Code scanning / CodeQL
Double escaping or unescaping High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 1 day ago
In general, to avoid double-unescaping when dealing with escape sequences, the escape character (here &) must be escaped first in the encoder and unescaped last in the decoder. This ensures that sequences like &lt; are handled correctly: the < entity is decoded first to <, and only then is & decoded where appropriate, preventing incorrect collapse into raw meta-characters.
For this specific code, escapeXml is already correct: it escapes & first, then <, >, ", and '. The issue is in unescapeXml, which currently unescapes & before the other entities. The best fix without changing existing functionality is to keep the same mappings but reorder the .replace calls so that & is handled last. That is, unescapeXml should first replace <, >, ", and ' with their character equivalents, and only then replace & with &.
Concretely, in tx/xml/xml-base.js at lines 356–362, adjust the implementation of static unescapeXml(str) so that the .replace(/&/g, '&') call is moved to the end of the chain. No new methods or imports are required.
| @@ -355,11 +355,11 @@ | ||
| */ | ||
| static unescapeXml(str) { | ||
| return str | ||
| .replace(/&/g, '&') | ||
| .replace(/</g, '<') | ||
| .replace(/>/g, '>') | ||
| .replace(/"/g, '"') | ||
| .replace(/'/g, "'"); | ||
| .replace(/'/g, "'") | ||
| .replace(/&/g, '&'); | ||
| } | ||
|
|
||
| /** |
No description provided.