From bd93155f1cd53bfa0eb15eaf2caf28a3b1305438 Mon Sep 17 00:00:00 2001
From: Ben Hutchings <ben@decadent.org.uk>
Date: Wed, 21 Dec 2005 01:45:55 +0000
Subject: [PATCH] Added XML-escaping of VOB filenames.

---
 webdvd.cpp | 35 ++++++++++++++++++++++++++++++++---
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/webdvd.cpp b/webdvd.cpp
index d0f2e05..cc47bd1 100644
--- a/webdvd.cpp
+++ b/webdvd.cpp
@@ -142,6 +142,36 @@ namespace
 	return result;
     }
 
+
+    std::string xml_escape(const std::string & str)
+    {
+	std::string result;
+	std::size_t begin = 0;
+
+	for (;;)
+	{
+	    std::size_t end = str.find_first_of("\"&'<>", begin);
+	    result.append(str, begin, end - begin);
+	    if (end == std::string::npos)
+		return result;
+
+	    const char * entity = NULL;
+	    switch (str[end])
+	    {
+	    case '"':  entity = "&quot;"; break;
+	    case '&':  entity = "&amp;";  break;
+	    case '\'': entity = "&apos;"; break;
+	    case '<':  entity = "&lt;";   break;
+	    case '>':  entity = "&gt;";   break;
+	    }
+	    assert(entity);
+	    result.append(entity);
+
+	    begin = end + 1;
+	}
+    }
+
+    
     struct dvd_contents
     {
 	enum pgc_type { menu_pgc, title_pgc };
@@ -171,7 +201,7 @@ namespace
 	std::vector<menu> menus;
 	std::vector<title> titles;
     };
-    
+
     class webdvd_window : public Gtk::Window
     {
     public:
@@ -280,8 +310,7 @@ namespace
 			filename + " is missing or not a regular file");
 		vob_list
 		    .append("<vob file='")
-		    // FIXME: Should XML-escape the path
-		    .append(filename)
+		    .append(xml_escape(filename))
 		    .append("'/>\n");
 	    }
 	    else
-- 
2.39.5