264369 - Escaping of '>' not compliant with 10.2.1.1 of ECMA 357

Status: RESOLVED FIXED

(Rhino Graveyard :: E4X, defect)

Description

[Kas Thomas]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7a) Gecko/20040219
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7a) Gecko/20040219

Spec says 
a. If (c == "<"), let r be the result of concatenating r and the string"&lt;"
b. Else if (c == ">"), let r be the result of concatenating r and the string "&gt;"
c. Else if (c == "&"), let r be the result of concatenating r and the string "&amp;"

Rhino is not obeying b.



Reproducible: Always
Steps to Reproduce:
1. Execute this code:

x = <a/>;
chars = "<>&";
x.b = chars;

2. Inspect x.toXMLString()


Actual Results:  
<a>
  <b>&lt;>&amp;</b>
</a>

Expected Results:  
<a>
  <b>&lt;&gt;&amp;</b>
</a>

I believe that if < is autoescaped, > should be also. Otherwise we're breaking
people's XML (and not complying with ECMA 357 10.2.1.1, I think). 

As a side issue, I think ECMA 357 10.2.1.1 should have gone all the way and
specified escaping all of the XML illegals, including ' and ".  Otherwise a lot
of illegal XML gets created.  As it now stands, ECMA 357 and XInclude
(text-mode) are out of agreement. I think it would be good if they agreed on how
to handle all 5 XML illegals.

Comment 1

[Brendan Eich [:brendan]]

Please file Rhino bugs against the Rhino bugzilla.mozilla.org product.

/be

Comment 2

[Igor Bukanov]

(In reply to comment #0)

> As a side issue, I think ECMA 357 10.2.1.1 should have gone all the way and
> specified escaping all of the XML illegals, including ' and ".  Otherwise a lot
> of illegal XML gets created.  As it now stands, ECMA 357 and XInclude
> (text-mode) are out of agreement. I think it would be good if they agreed on how
> to handle all 5 XML illegals.

Why do you think that ', ", and > are illegal? Here is a mail from Eric Vasilik
that I got when investigating the issue (Rhino uses http://xmlbeans.apache.org/
to implement E4X and directly call xmlText method there): 



-------- Original Message --------
Subject: RE: No escape for '>' ?
Date: Fri, 15 Oct 2004 11:31:46 -0700
From: Eric Vasilik
Reply-To: [e-mail]
To: <[e-mail]>

I do not believe that "<a>&lt;>&amp;</a>" is invalid.  The '>' character
does not need to be escaped.  Here is the BNF for char data from the XML
spec.

[14]    CharData    ::=    [^<&]* - ([^<&]* ']]>' [^<&]*) 

It requires that there are no un-escaped '&' or '<' characters, as well
as the CDATA terminating character sequence.

- Eric


> -----Original Message-----
> From: Igor Bukanov [mailto:[e-mail]]
> Sent: Friday, October 15, 2004 6:10 AM
> To: [e-mail]
> Subject: No escape for '>' ?
> 
> Hi!
> 
> It seems that xmlText() does not escape '>'. For example,
> xmlCursor.xmlText() when xmlCursor points to a XML fragement
<a>TEXT</a>
> where TEXT is "<>&" produces  instead of the expected
> <a>&lt;&gt;&amp;</a>
> the following invalid XML:
> <a>&lt;>&amp;</a>
> 
> Regards, Igor

Comment 3

[Igor Bukanov]

Reassigning to [e-mail] pending resolution of bug 288433

Comment 4

[David Caldwell]

This bug is fixed in the upcoming DOM-only (non-XMLBeans) version of E4X support.  See bug 355677.

Comment 5

[David Caldwell]

Rhino now passes this test if XMLBeans is not present (see bug 355677).

Comment 6

[Norris Boyd]

Adding target milestone of 1.6R6 based on the date this bug was resolved FIXED.