fixed an XML entites content serialization potentially triggered by

* entities.c: fixed an XML entites content serialization
  potentially triggered by XInclude, see #126817
Daniel

1 files changed, 44 insertions, 2 deletions

diff --git a/entities.c b/entities.c
index 0b0df65c..db1c4c9c 100644
--- a/entities.c
+++ b/entities.c
@@ -743,6 +743,48 @@ xmlCopyEntitiesTable(xmlEntitiesTablePtr table) {
 #endif /* LIBXML_TREE_ENABLED */
 
 #ifdef LIBXML_OUTPUT_ENABLED
+
+/**
+ * xmlDumpEntityContent:
+ * @buf:  An XML buffer.
+ * @content:  The entity content.
+ *
+ * This will dump the quoted string value, taking care of the special
+ * treatment required by %
+ */
+static void
+xmlDumpEntityContent(xmlBufferPtr buf, const xmlChar *content) {
+    if (buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) return;
+    if (xmlStrchr(content, '%')) {
+        const xmlChar * base, *cur;
+
+	xmlBufferCCat(buf, "\"");
+	base = cur = content;
+	while (*cur != 0) {
+	    if (*cur == '"') {
+		if (base != cur)
+		    xmlBufferAdd(buf, base, cur - base);
+		xmlBufferAdd(buf, BAD_CAST """, 6);
+		cur++;
+		base = cur;
+	    } else if (*cur == '%') {
+		if (base != cur)
+		    xmlBufferAdd(buf, base, cur - base);
+		xmlBufferAdd(buf, BAD_CAST "%", 6);
+		cur++;
+		base = cur;
+	    } else {
+		cur++;
+	    }
+	}
+	if (base != cur)
+	    xmlBufferAdd(buf, base, cur - base);
+	xmlBufferCCat(buf, "\"");
+    } else {
+        xmlBufferWriteQuotedString(buf, content);
+    }
+}
+
 /**
  * xmlDumpEntityDecl:
  * @buf:  An XML buffer.
@@ -760,7 +802,7 @@ xmlDumpEntityDecl(xmlBufferPtr buf, xmlEntityPtr ent) {
 	    if (ent->orig != NULL)
 		xmlBufferWriteQuotedString(buf, ent->orig);
 	    else
-		xmlBufferWriteQuotedString(buf, ent->content);
+		xmlDumpEntityContent(buf, ent->content);
 	    xmlBufferWriteChar(buf, ">\n");
 	    break;
 	case XML_EXTERNAL_GENERAL_PARSED_ENTITY:
@@ -803,7 +845,7 @@ xmlDumpEntityDecl(xmlBufferPtr buf, xmlEntityPtr ent) {
 	    xmlBufferWriteCHAR(buf, ent->name);
 	    xmlBufferWriteChar(buf, " ");
 	    if (ent->orig == NULL)
-		xmlBufferWriteQuotedString(buf, ent->content);
+		xmlDumpEntityContent(buf, ent->content);
 	    else
 		xmlBufferWriteQuotedString(buf, ent->orig);
 	    xmlBufferWriteChar(buf, ">\n");