(tomcat) branch 11.0.x updated: Ensure namespace attributes are XML escaped in WebDAV responses

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/11.0.x by this push:
     new 27c6b2f4cf Ensure namespace attributes are XML escaped in WebDAV responses
27c6b2f4cf is described below

commit 27c6b2f4cf1344d4e9bb24de1229a866c02e40f7
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Aug 26 08:00:40 2026 +0100

    Ensure namespace attributes are XML escaped in WebDAV responses
---
 java/org/apache/catalina/util/XMLWriter.java | 9 +++++----
 webapps/docs/changelog.xml                   | 3 +++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/java/org/apache/catalina/util/XMLWriter.java b/java/org/apache/catalina/util/XMLWriter.java
index 978cc0cf0d..ca83a76836 100644
--- a/java/org/apache/catalina/util/XMLWriter.java
+++ b/java/org/apache/catalina/util/XMLWriter.java
@@ -144,7 +144,7 @@ public class XMLWriter {
                     }
                     if (namespaceInfo != null) {
                         buffer.append("<").append(namespace).append(":").append(name).append(" xmlns:")
-                                .append(namespace).append("=\"").append(namespaceInfo).append("\">");
+                                .append(namespace).append("=\"").append(Escape.xml(namespaceInfo)).append("\">");
                     } else {
                         buffer.append("<").append(namespace).append(":").append(name).append(">");
                     }
@@ -161,7 +161,7 @@ public class XMLWriter {
                     }
                     if (namespaceInfo != null) {
                         buffer.append("<").append(namespace).append(":").append(name).append(" xmlns:")
-                                .append(namespace).append("=\"").append(namespaceInfo).append("\"/>\n");
+                                .append(namespace).append("=\"").append(Escape.xml(namespaceInfo)).append("\"/>\n");
                     } else {
                         buffer.append("<").append(namespace).append(":").append(name).append("/>\n");
                     }
@@ -174,7 +174,7 @@ public class XMLWriter {
                     if (lastWriteWasOpen) {
                         buffer.append('\n');
                     }
-                    buffer.append("<").append(name).append(" xmlns=\"").append(namespaceInfo).append("\">");
+                    buffer.append("<").append(name).append(" xmlns=\"").append(Escape.xml(namespaceInfo)).append("\">");
                     lastWriteWasOpen = true;
                     break;
                 case CLOSING:
@@ -186,7 +186,8 @@ public class XMLWriter {
                     if (lastWriteWasOpen) {
                         buffer.append('\n');
                     }
-                    buffer.append("<").append(name).append(" xmlns=\"").append(namespaceInfo).append("\"/>\n");
+                    buffer.append("<").append(name).append(" xmlns=\"").append(Escape.xml(namespaceInfo))
+                            .append("\"/>\n");
                     lastWriteWasOpen = false;
                     break;
             }
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 69c11dbdb1..5a2c585650 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -155,6 +155,9 @@
         includes not swapping out a session unless the session was created when
         activity tracking was enabled. (markt)
       </fix>
+      <fix>
+        Ensure namespace attributes are XML escaped in WebDAV responses. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">