Package io.jenkins.plugins.configsplice.engine.xml

Class XmlAttributes

java.lang.Object

io.jenkins.plugins.configsplice.engine.xml.XmlAttributes

public final class XmlAttributes
extends Object

Escaping and unescaping of XML attribute values.

Both directions are needed. Decoding lets the locator compare a user-supplied key such as A&B against source text written as A&B. Encoding produces a replacement that is correct for the quote character actually used at the target site, so a value containing a quote can never break out of the attribute — which is the injection concern here, and the reason escaping is driven by the observed source quote rather than by a fixed convention.

Method Summary

Modifier and Type	Method	Description
static String	decode(String raw)	Decodes the predefined XML entities and numeric character references.
static String	encode(String value, char quote)	Escapes value for insertion between quote characters.
static String	encodeText(String value)	Escapes value for use as element text rather than as an attribute value.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

encode

public static String encode(String value,
 char quote)

Escapes value for insertion between quote characters.

& and < are always escaped because they are never legal literally in an attribute value. > is escaped defensively. Only the delimiting quote is escaped, so an apostrophe inside a double-quoted attribute stays readable.

encodeText

public static String encodeText(String value)

Escapes value for use as element text rather than as an attribute value.

Quotes are left alone: inside element content they carry no structural meaning, and escaping them would churn bytes for no reason. & and < must be escaped because they are never legal literally; > is escaped defensively so that no accidental ]]> sequence can form.

decode

public static String decode(String raw)

Decodes the predefined XML entities and numeric character references.

Custom entities are not decoded: DTDs are disabled outright, so a document that defines one has already been rejected before this runs. Anything unrecognised is left verbatim rather than guessed at.