Bug 66609

Summary: invalid XML in directory listing with file names containing "&" and "'"
Product: Tomcat 8 Reporter: webmascon <alexkachanov>
Component: CatalinaAssignee: Tomcat Developers Mailing List <dev>
Status: RESOLVED FIXED    
Severity: normal    
Priority: P2    
Version: 8.5.x-trunk   
Target Milestone: ----   
Hardware: PC   
OS: All   

Description webmascon 2023-05-21 23:20:31 UTC
similar to bug 33535: if files in a directroy contain "'" or "&" symbols, generted XML is not valid and XSLT style sheet cannot be applied to render the directory listing. 

Cause: DefaultServelt considers "'" as a valid character on URLEncoder.DEFAULT, renderXML surronds attributes with ' symbol, and thus XML generated by renderXML may contain invalid entry with url attribute like this <entry urlPath='file's name.txt' />
Comment 1 Han Li 2023-05-22 02:00:54 UTC

*** This bug has been marked as a duplicate of bug 33535 ***
Comment 2 webmascon 2023-05-22 02:16:09 UTC
The bug may be similar to bug 33535, but bug 33535 says only about & in the names of the files. My bug report says that there are can be symbols that are not valid for XML, such as symbol "'". And I have a simple solution to that which I was goign to provide as a fix for this bug.
Comment 3 Han Li 2023-05-22 02:24:13 UTC
(In reply to webmascon from comment #2)
> The bug may be similar to bug 33535, but bug 33535 says only about & in the
> names of the files. My bug report says that there are can be symbols that
> are not valid for XML, such as symbol "'". 
IMO, Those reports are all about handling file names that contain special characters which lead XML is invalided.

> And I have a simple solution to that which I was goign to provide as a fix for this bug.

Great.
Comment 4 webmascon 2023-05-24 00:13:57 UTC
created pull request: https://github.com/apache/tomcat/pull/621
Comment 5 Han Li 2023-05-25 01:45:20 UTC
Fixed in:
- 11.0.x for 11.0.0-M7 onwards
- 10.1.x for 10.1.10 onwards
- 9.0.x for 9.0.76 onwards
- 8.5.x for 8.5.90 onwards
Comment 6 webmascon 2023-05-27 11:24:10 UTC
thanks!