Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-1188

Apache XML-RPC library blows up on high-bit chars

XMLWordPrintable

      a) The XML-RPC server defaults to serving ISO-8859-1 instead of UTF-8.
      b) The XmlWriter class will blow up on any character > 0xFF, which seems rather, well, stupid.

      Fix, and make a patched library jar available for users.

        1. xmlrpc-1.2-b1-atlassian.jar
          63 kB

            [CONFSERVER-1188] Apache XML-RPC library blows up on high-bit chars

            Charles Miller (Inactive) added a comment -

            Index: src/java/org/apache/xmlrpc/XmlRpc.java
            ===================================================================
            RCS file: /home/cvspublic/ws-xmlrpc/src/java/org/apache/xmlrpc/XmlRpc.java,v
            retrieving revision 1.35
            diff -r1.35 XmlRpc.java
            185c185
            < * <code>ISO8859_1</code>.
            —
            > * <code>UTF-8</code>. (Changed by Charles)
            187c187
            < static String encoding = XmlWriter.ISO8859_1;
            —
            > static String encoding = XmlWriter.UTF8;
            Index: src/java/org/apache/xmlrpc/XmlWriter.java
            ===================================================================
            RCS file: /home/cvspublic/ws-xmlrpc/src/java/org/apache/xmlrpc/XmlWriter.java,v
            retrieving revision 1.6
            diff -r1.6 XmlWriter.java
            335c335
            < if (c < 0x20 || c > 0xff)
            —
            > if (isInvalidXmlChar(c))
            337,344c337,339
            < // Though the XML-RPC spec allows any ASCII
            < // characters except '<' and '&', the XML spec
            < // does not allow this range of characters,
            < // resulting in a parse error from most XML
            < // parsers.
            < throw new XmlRpcException(0, "Invalid character data " +
            < "corresponding to XML entity &#" +
            < String.valueOf((int) c) + ';');
            —
            > write("&#");
            > write(String.valueOf((int)c));
            > write(';');
            351a347,354
            > }
            >
            > private boolean isInvalidXmlChar(char c)
            > {
            > if (c == 0x09 || c == 0x0A || c == 0x0D)
            > return false;
            >
            > return c < 0x20 || (c > 0xD7FF && c < 0xE000) || c > 0xFFFD;

            Charles Miller (Inactive) added a comment - Index: src/java/org/apache/xmlrpc/XmlRpc.java =================================================================== RCS file: /home/cvspublic/ws-xmlrpc/src/java/org/apache/xmlrpc/XmlRpc.java,v retrieving revision 1.35 diff -r1.35 XmlRpc.java 185c185 < * <code>ISO8859_1</code>. — > * <code>UTF-8</code>. (Changed by Charles) 187c187 < static String encoding = XmlWriter.ISO8859_1; — > static String encoding = XmlWriter.UTF8; Index: src/java/org/apache/xmlrpc/XmlWriter.java =================================================================== RCS file: /home/cvspublic/ws-xmlrpc/src/java/org/apache/xmlrpc/XmlWriter.java,v retrieving revision 1.6 diff -r1.6 XmlWriter.java 335c335 < if (c < 0x20 || c > 0xff) — > if (isInvalidXmlChar(c)) 337,344c337,339 < // Though the XML-RPC spec allows any ASCII < // characters except '<' and '&', the XML spec < // does not allow this range of characters, < // resulting in a parse error from most XML < // parsers. < throw new XmlRpcException(0, "Invalid character data " + < "corresponding to XML entity &#" + < String.valueOf((int) c) + ';'); — > write("&#"); > write(String.valueOf((int)c)); > write(';'); 351a347,354 > } > > private boolean isInvalidXmlChar(char c) > { > if (c == 0x09 || c == 0x0A || c == 0x0D) > return false; > > return c < 0x20 || (c > 0xD7FF && c < 0xE000) || c > 0xFFFD;

            Charles Miller (Inactive) added a comment -

            Attaching a drop-in replacement for WEB-INF/lib/xmlrpc.jar that fixes this problem:

            Charles Miller (Inactive) added a comment - Attaching a drop-in replacement for WEB-INF/lib/xmlrpc.jar that fixes this problem:

              cmiller@atlassian.com Charles Miller (Inactive)
              cmiller@atlassian.com Charles Miller (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: