Out of office: jcoffey-dev is traveling from November 1 to November 6. Responses to issues may be slow or delayed during this time, but I will be checking in.
Dead properties set with PROPPATCH and the owner given in a LOCK are
stored as sent and written into PROPFIND and lock responses. Attribute
values (and the namespace) were copied between double quotes without
escaping, so a value quoted with ' that held a " ended the attribute and
let the rest be written as markup. Any user able to set a property or
lock a resource could put elements of their choosing into the responses
other users of a shared calendar, address book or folder read. Nested
properties were also closed with the innermost element's name, giving
malformed XML.
Attribute values and the namespace are now escaped for double quotes
when stored, names that can't be written back as names are replaced,
and on output, attributes already stored are written only while they
are plain name="value" pairs. Each end tag closes the element opened
last.
Test: dav-proto dead_property_round_trip_is_well_formed got
"<note xmlns=\"urn:example:z\" a=\"x\" ><evil/>\" ..." and "expected
`</outer>`, but `</empty>` was found" on main; now the output parses
with the same elements and attribute values, and stored attributes
holding markup are cut off at it.
jcoffey-dev
7ddb70d535