Menu

#1 values not encoded

open
nobody
None
5
2012-02-17
2012-02-17
Anonymous
No

We were considering using this library but looking at code like:
https://ctctwsjavalib.svn.sourceforge.net/svnroot/ctctwsjavalib/src/com/ctctlabs/ctctwsjavalib/ContactList.java
We see values aren't xml encoded. For example one of the lines from the code is
"<Name>" + attributes.get("Name") + "</Name>" +
If someone entered a name like "Jack & Jill" we would end up with xml
<Name>Jack & Jill</Name>
which of course isn't valid. It needs to be
<Name>Jack &amp; Jill</Name>

Discussion


Log in to post a comment.