alexandrev/xslt-lab
1
0
Fork 0
mirror of https://github.com/alexandrev/xslt-lab.git synced 2026-09-13 08:43:16 +00:00
Code Packages Releases Activity

Fix: html.UnescapeString corrupts XML params with & entities

Browse Source 
When an XML parameter value starts with '<', html.UnescapeString was
incorrectly called, converting &amp; → & and breaking well-formed
XML that contained entity references. Only apply HTML decoding when
the value starts with '&lt;' (HTML-encoded XML sent from a form field).

Fixes: 'The entity name must immediately follow the & in entity reference'
error reported when XML input contains & characters escaped as &amp;.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
alexandrev-tibco
2026-06-11 13:42:51 +02:00
parent d08c525949
commit e2fdbfd296
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/main.go
+6 -1
View File
@@ -199,8 +199,13 @@ func main() {
continue
}
trimmed := strings.TrimSpace(v)
if strings.HasPrefix(trimmed, "&lt;") || strings.HasPrefix(trimmed, "<") {
if strings.HasPrefix(trimmed, "&lt;") {
// HTML-encoded XML (e.g. sent from a form field): decode first
fileParams[k] = html.UnescapeString(trimmed)
} else if strings.HasPrefix(trimmed, "<") {
// Already valid XML — do NOT call html.UnescapeString or it will
// convert &amp; → & and break well-formed entity references
fileParams[k] = trimmed
} else {
stringParams[k] = v
}