Validate entity names against invalid XML chars

Wire XmlChars.requireValidAttributeContent into TokenMangler.checkNameProperty
(used by BioModel, MathModel, Simulation, SimulationContext, Structure name
vetos) and into ReactionStep.vetoableChange("name"). Allows whitespace but
rejects C0 control chars and U+FFFD, so that bad chars from external
sources can't reach the VCML attribute payload via setName.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jcschaff

vcell-core/src/main/java/cbit/vcell/model/ReactionStep.java

@@ -28,6 +28,7 @@
 import org.vcell.util.IssueContext.ContextType;
 import org.vcell.util.document.Identifiable;
 import org.vcell.util.document.KeyValue;
+import org.vcell.util.xml.XmlChars;
 
 import cbit.vcell.model.Kinetics.KineticsParameter;
 import cbit.vcell.model.Membrane.MembraneVoltage;
@@ -1065,7 +1066,7 @@ public void setSbmlId(String newValue) throws PropertyVetoException{
 
     public void setSbmlName(String newString) throws PropertyVetoException{
         String oldValue = this.sbmlName;
-        String newValue = SpeciesContext.fixSbmlName(newString);
+        String newValue = SpeciesContext.fixAndValidateSbmlName(newString, this);
 
         fireVetoableChange("sbmlName", oldValue, newValue);
         this.sbmlName = newValue;
@@ -1167,6 +1168,11 @@ public void vetoableChange(PropertyChangeEvent e) throws PropertyVetoException{
             if(((String) (e.getNewValue())).trim().length() > 255){
                 throw new PropertyVetoException("reactionStep name for reaction \'" + (String) (e.getNewValue()) + "\' cannot be longer than 255 characters", e);
             }
+            try {
+                XmlChars.requireValidAttributeContent((String) e.getNewValue(), "Reaction.name");
+            } catch (IllegalArgumentException ex) {
+                throw new PropertyVetoException(ex.getMessage(), e);
+            }
         }
         if(e.getSource() == this && e.getPropertyName().equals("chargeCarrierValence")){
             if((e.getNewValue() != null) && ((Integer) (e.getNewValue())).intValue() != 0){

vcell-util/src/main/java/org/vcell/util/TokenMangler.java

@@ -10,6 +10,8 @@
 
 package org.vcell.util;
 
+import org.vcell.util.xml.XmlChars;
+
 import java.beans.PropertyChangeEvent;
 import java.beans.PropertyVetoException;
 
@@ -453,12 +455,17 @@ public static void checkLoginID(String loginID) throws IllegalArgumentException
  */
 public static void checkNameProperty(Object source, String owner, PropertyChangeEvent evt) throws PropertyVetoException {
 	if (evt.getSource() == source && evt.getPropertyName().equals("name") && evt.getNewValue()!=null){
-		if (evt.getNewValue() == null || ((String)evt.getNewValue()).trim().length()==0){
+		String newName = (String) evt.getNewValue();
+		if (newName.trim().length()==0){
 			throw new PropertyVetoException("A name must be given to save " + owner + "s", evt);
-		} 
-//		else if (((String)evt.getNewValue()).contains("'")){
-//			throw new PropertyVetoException("Apostrophe is not allowed in " + owner + " names",evt);
-//		}
+		}
+		try {
+			// allow whitespace (entity names like BioModel may contain spaces)
+			// but reject control characters and U+FFFD
+			XmlChars.requireValidAttributeContent(newName, owner + ".name");
+		} catch (IllegalArgumentException ex) {
+			throw new PropertyVetoException(ex.getMessage(), evt);
+		}
 	}
 }