From a75d2d7d0db28cceedf3859901979f5ed3b63091 Mon Sep 17 00:00:00 2001
From: Florian Schmaus <flo@geekplace.eu>
Date: Thu, 31 Jan 2013 22:30:36 +0000
Subject: [PATCH] SMACK-375 Properly escape Strings in DiscoverInfo and
 DiscoverItems for XML.

git-svn-id: http://svn.igniterealtime.org/svn/repos/smack/trunk@13417 b35dd754-fafc-0310-a699-88a17e54d16e
---
 .../jivesoftware/smackx/packet/DiscoverInfo.java    | 13 +++++++------
 .../jivesoftware/smackx/packet/DiscoverItems.java   | 11 ++++++-----
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/source/org/jivesoftware/smackx/packet/DiscoverInfo.java b/source/org/jivesoftware/smackx/packet/DiscoverInfo.java
index 18ebe427b..eeda1bfc8 100644
--- a/source/org/jivesoftware/smackx/packet/DiscoverInfo.java
+++ b/source/org/jivesoftware/smackx/packet/DiscoverInfo.java
@@ -21,6 +21,7 @@
 package org.jivesoftware.smackx.packet;
 
 import org.jivesoftware.smack.packet.IQ;
+import org.jivesoftware.smack.util.StringUtils;
 
 import java.util.Collections;
 import java.util.Iterator;
@@ -135,7 +136,7 @@ public class DiscoverInfo extends IQ {
         buf.append("<query xmlns=\"http://jabber.org/protocol/disco#info\"");
         if (getNode() != null) {
             buf.append(" node=\"");
-            buf.append(getNode());
+            buf.append(StringUtils.escapeForXML(getNode()));
             buf.append("\"");
         }
         buf.append(">");
@@ -222,10 +223,10 @@ public class DiscoverInfo extends IQ {
 
         public String toXML() {
             StringBuilder buf = new StringBuilder();
-            buf.append("<identity category=\"").append(category).append("\"");
-            buf.append(" name=\"").append(name).append("\"");
+            buf.append("<identity category=\"").append(StringUtils.escapeForXML(category)).append("\"");
+            buf.append(" name=\"").append(StringUtils.escapeForXML(name)).append("\"");
             if (type != null) {
-                buf.append(" type=\"").append(type).append("\"");
+                buf.append(" type=\"").append(StringUtils.escapeForXML(type)).append("\"");
             }
             buf.append("/>");
             return buf.toString();
@@ -262,8 +263,8 @@ public class DiscoverInfo extends IQ {
 
         public String toXML() {
             StringBuilder buf = new StringBuilder();
-            buf.append("<feature var=\"").append(variable).append("\"/>");
+            buf.append("<feature var=\"").append(StringUtils.escapeForXML(variable)).append("\"/>");
             return buf.toString();
         }
     }
-}
\ No newline at end of file
+}
diff --git a/source/org/jivesoftware/smackx/packet/DiscoverItems.java b/source/org/jivesoftware/smackx/packet/DiscoverItems.java
index 0593192fa..d1ea1b954 100644
--- a/source/org/jivesoftware/smackx/packet/DiscoverItems.java
+++ b/source/org/jivesoftware/smackx/packet/DiscoverItems.java
@@ -21,6 +21,7 @@
 package org.jivesoftware.smackx.packet;
 
 import org.jivesoftware.smack.packet.IQ;
+import org.jivesoftware.smack.util.StringUtils;
 
 import java.util.Collections;
 import java.util.Iterator;
@@ -94,7 +95,7 @@ public class DiscoverItems extends IQ {
         buf.append("<query xmlns=\"http://jabber.org/protocol/disco#items\"");
         if (getNode() != null) {
             buf.append(" node=\"");
-            buf.append(getNode());
+            buf.append(StringUtils.escapeForXML(getNode()));
             buf.append("\"");
         }
         buf.append(">");
@@ -222,16 +223,16 @@ public class DiscoverItems extends IQ {
             StringBuilder buf = new StringBuilder();
             buf.append("<item jid=\"").append(entityID).append("\"");
             if (name != null) {
-                buf.append(" name=\"").append(name).append("\"");
+                buf.append(" name=\"").append(StringUtils.escapeForXML(name)).append("\"");
             }
             if (node != null) {
-                buf.append(" node=\"").append(node).append("\"");
+                buf.append(" node=\"").append(StringUtils.escapeForXML(node)).append("\"");
             }
             if (action != null) {
-                buf.append(" action=\"").append(action).append("\"");
+                buf.append(" action=\"").append(StringUtils.escapeForXML(action)).append("\"");
             }
             buf.append("/>");
             return buf.toString();
         }
     }
-}
\ No newline at end of file
+}