Conversation
Fixes apache#3399. Preserve valid supplementary Unicode and streamed UTF-8 while replacing invalid XML 1.0 code points in attributes, text, CDATA, and system properties.
2a4c279 to
26feedd
Compare
There was a problem hiding this comment.
Pull request overview
Sanitizes invalid XML 1.0 characters so Surefire reports remain parseable.
Changes:
- Sanitizes attributes, properties, stack traces, and output.
- Adds streaming UTF-8 validation and CDATA handling.
- Adds regression coverage for invalid characters and chunk boundaries.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
StatelessXmlReporter.java |
Implements XML and UTF-8 sanitization. |
StatelessXmlReporterTest.java |
Tests report generation with invalid characters. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| stdout.append('a'); | ||
| } | ||
| stdout.append('\uFFFF').append(" ]]> "); | ||
| stdOut.write(stdout.toString(), false, null); |
There was a problem hiding this comment.
Addressed in f270ce7. Added a raw-byte regression test covering an invalid leading byte, an invalid continuation across writes, a valid four-byte sequence split across writes, and an incomplete sequence flushed by finish(). The test parses the resulting XML and asserts the exact U+FFFD replacements. Local verification: StatelessXmlReporterTest — 14 tests, 0 failures/errors/skips; Checkstyle, Spotless, RAT, enforcer, compilation, and the prerequisite reactor install also passed.
|
Hi maintainers, following up on this PR since it has not yet received a human review. The latest CI matrix is green and the XML-sanitization fix is ready for review. I am happy to rebase or address any feedback. Thank you. |
elharo
left a comment
elharo
left a comment
There was a problem hiding this comment.
The code looks wrong but I'm not going to dig into it in detail because the architecture is definitely wrong. This should use utility classes that can fully handle XML writing, not try to write it by hand at the byte level. Text and byte data need to be cleanly separated.
| Utf8RecodingDeferredFileOutputStream utf8RecodingDeferredFileOutputStream, | ||
| String name) | ||
| String name, | ||
| OutputStream fw) |
There was a problem hiding this comment.
what's fw? don't use abbreviations
Fixes #3399
What changed
Validation
The full reactor test compile was not reliable in this Windows/JDK 25 environment because of a reactor classpath/forked compiler issue; the focused reporter suite passed.
Apache checklist