[KNOWAGE-9198] Escape XML attributes in TriggerXMLSerializer and SchedulerUtilitiesV2

Author: eng-dedalus

knowage-core/src/main/java/it/eng/spagobi/commons/deserializer/XMLDeserializer.java

@@ -80,6 +80,4 @@ public Object deserialize(Object o, Class clazz) throws DeserializationException
 
 		return result;	
 	}
-
-
 }

knowage-core/src/main/java/it/eng/spagobi/commons/serializer/TriggerXMLSerializer.java

@@ -144,6 +144,7 @@ public Object serialize(Object o, Locale locale) throws SerializationException {
 				Set<String> jobParametersName = jobParameters.keySet();
 				for (String jobParameterName : jobParametersName) {
 					String jobParameterValue = jobParameters.get(jobParameterName);
+					jobParameterValue = escapeXmlAttribute(jobParameterValue);
 					// already extracted and processed
 //					if(jobParameterName.equals("chronString")) {
 //						continue;
@@ -176,6 +177,16 @@ public Object serialize(Object o, Locale locale) throws SerializationException {
 		return result.toString();
 	}
 
+	private String escapeXmlAttribute(String text) {
+		if (text == null) return null;
+		return text
+				.replace("&", "&amp;")   // DEVE essere il primo!
+				.replace("<", "&lt;")
+				.replace(">", "&gt;")
+				.replace("\"", "&quot;")
+				.replace("'", "&apos;");
+	}
+
 	public String serailizeTime(Date date) {
 		String serializedTime;
 

knowage-core/src/main/java/it/eng/spagobi/tools/scheduler/utils/SchedulerUtilitiesV2.java

@@ -547,7 +547,7 @@ private static String serializeSaveAsMailOptions(DispatchContext dispatchContext
 				saveOptString += "mailsubj=" + dispatchContext.getMailSubj() + "%26";
 			}
 			if ((dispatchContext.getMailTxt() != null) && !dispatchContext.getMailTxt().trim().equals("")) {
-				saveOptString += "mailtxt=" + dispatchContext.getMailTxt() + "%26";
+				saveOptString += "mailtxt=" + escapeXmlAttribute(dispatchContext.getMailTxt()) + "%26";
 			}
 
 			// Mail
@@ -574,6 +574,17 @@ private static String serializeSaveAsMailOptions(DispatchContext dispatchContext
 		return saveOptString;
 	}
 
+
+	private static String escapeXmlAttribute(String text) {
+		if (text == null) return null;
+		return text
+				.replace("&", "&")
+				.replace("<", "&lt;")
+				.replace(">", "&gt;")
+				.replace("\"", "&quot;")
+				.replace("'", "&apos;");
+	}
+
 	private static String serializeSaveAsDistributionListOptions(DispatchContext dispatchContext,
 			String uniqueDispatchContextName, JobTrigger triggerInfo, boolean runImmediately, IEngUserProfile profile)
 			throws EMFUserError {