X-Git-Url: https://git.decadent.org.uk/gitweb/?p=videolink.git;a=blobdiff_plain;f=webdvd.cpp;h=cc47bd140eb026f2c5fa33452057ca8b65c77dad;hp=d0f2e05f3e8dd2f9718f4f47e9636f119828ee3d;hb=bd93155f1cd53bfa0eb15eaf2caf28a3b1305438;hpb=51e4ad8512a2b11da8737f345676b03d94e0fa2a

diff --git a/webdvd.cpp b/webdvd.cpp
index d0f2e05..cc47bd1 100644
--- a/webdvd.cpp
+++ b/webdvd.cpp
@@ -142,6 +142,36 @@ namespace
 	return result;
     }
 
+
+    std::string xml_escape(const std::string & str)
+    {
+	std::string result;
+	std::size_t begin = 0;
+
+	for (;;)
+	{
+	    std::size_t end = str.find_first_of("\"&'<>", begin);
+	    result.append(str, begin, end - begin);
+	    if (end == std::string::npos)
+		return result;
+
+	    const char * entity = NULL;
+	    switch (str[end])
+	    {
+	    case '"':  entity = "&quot;"; break;
+	    case '&':  entity = "&amp;";  break;
+	    case '\'': entity = "&apos;"; break;
+	    case '<':  entity = "&lt;";   break;
+	    case '>':  entity = "&gt;";   break;
+	    }
+	    assert(entity);
+	    result.append(entity);
+
+	    begin = end + 1;
+	}
+    }
+
+    
     struct dvd_contents
     {
 	enum pgc_type { menu_pgc, title_pgc };
@@ -171,7 +201,7 @@ namespace
 	std::vector<menu> menus;
 	std::vector<title> titles;
     };
-    
+
     class webdvd_window : public Gtk::Window
     {
     public:
@@ -280,8 +310,7 @@ namespace
 			filename + " is missing or not a regular file");
 		vob_list
 		    .append("<vob file='")
-		    // FIXME: Should XML-escape the path
-		    .append(filename)
+		    .append(xml_escape(filename))
 		    .append("'/>\n");
 	    }
 	    else