345346 - config.cgi's XML format does "FILTER uri" or "FILTER html" where it should do "FILTER xml"

Status: RESOLVED DUPLICATE of bug 264785

(Bugzilla :: Bugzilla-General, defect)

Description

[Max Kanat-Alexander]

Here's a sample line from template/en/default/config.rdf.html:

> <bz:product rdf:about="[% Param('urlbase') %]product.cgi?name=[% product.name FILTER uri %]">

If the product.name has an & symbol in it, then that's invalid XML, because the & won't be escaped.

Also, this file has "FILTER html" all over it, when it really ought to have "FILTER xml" as far as I can see.

CC'ing folks who ought to be able to tell me at least whether or not I'm totally correct, from an XML standpoint.

config.cgi is supposed to be a stable API, though, so we shouldn't change it on the branches.

Comment 1

[Frédéric Buclin]

(In reply to comment #0)
> If the product.name has an & symbol in it, then that's invalid XML, because the
> & won't be escaped.

No, |FILTER uri| in TT 2.16 and newer correctly escapes all reserved characters:

* Changed the uri filter to escape all reserved characters as per 
  URI::Escape and RFC2396.  This now includes &, @, /, ;, :, =, +, ?
  and $ which were previously not escaped.

So using this filter is fine. Not sure about FILTER html and FILTER xml, though.