(tomcat) branch 9.0.x updated: Ensure namespace attributes are XML escaped in WebDAV responses

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/9.0.x by this push:
     new 15836856a7 Ensure namespace attributes are XML escaped in WebDAV responses
15836856a7 is described below

commit 15836856a75e63a1e484bbdb30140e361d940692
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Aug 26 08:00:40 2026 +0100

    Ensure namespace attributes are XML escaped in WebDAV responses
---
 java/org/apache/catalina/util/XMLWriter.java | 9 +++++----
 webapps/docs/changelog.xml                   | 3 +++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/java/org/apache/catalina/util/XMLWriter.java b/java/org/apache/catalina/util/XMLWriter.java
index 978cc0cf0d..ca83a76836 100644
--- a/java/org/apache/catalina/util/XMLWriter.java
+++ b/java/org/apache/catalina/util/XMLWriter.java
@@ -144,7 +144,7 @@ public class XMLWriter {
                     }
                     if (namespaceInfo != null) {
                         buffer.append("<").append(namespace).append(":").append(name).append(" xmlns:")
-                                .append(namespace).append("=\"").append(namespaceInfo).append("\">");
+                                .append(namespace).append("=\"").append(Escape.xml(namespaceInfo)).append("\">");
                     } else {
                         buffer.append("<").append(namespace).append(":").append(name).append(">");
                     }
@@ -161,7 +161,7 @@ public class XMLWriter {
                     }
                     if (namespaceInfo != null) {
                         buffer.append("<").append(namespace).append(":").append(name).append(" xmlns:")
-                                .append(namespace).append("=\"").append(namespaceInfo).append("\"/>\n");
+                                .append(namespace).append("=\"").append(Escape.xml(namespaceInfo)).append("\"/>\n");
                     } else {
                         buffer.append("<").append(namespace).append(":").append(name).append("/>\n");
                     }
@@ -174,7 +174,7 @@ public class XMLWriter {
                     if (lastWriteWasOpen) {
                         buffer.append('\n');
                     }
-                    buffer.append("<").append(name).append(" xmlns=\"").append(namespaceInfo).append("\">");
+                    buffer.append("<").append(name).append(" xmlns=\"").append(Escape.xml(namespaceInfo)).append("\">");
                     lastWriteWasOpen = true;
                     break;
                 case CLOSING:
@@ -186,7 +186,8 @@ public class XMLWriter {
                     if (lastWriteWasOpen) {
                         buffer.append('\n');
                     }
-                    buffer.append("<").append(name).append(" xmlns=\"").append(namespaceInfo).append("\"/>\n");
+                    buffer.append("<").append(name).append(" xmlns=\"").append(Escape.xml(namespaceInfo))
+                            .append("\"/>\n");
                     lastWriteWasOpen = false;
                     break;
             }
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 3bf1db40d2..025ded8c4d 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -167,6 +167,9 @@
         Fix parsing of client certificates that specify more than one OCSP
         responder for configurations that use OpenSSL-FFM. (markt)
       </fix>
+      <fix>
+        Ensure namespace attributes are XML escaped in WebDAV responses. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Cluster">