[JIRA] Created: (CC-1040) Errors/Failures output in test details not escaped properly

Errors/Failures output in test details not escaped properly
-----------------------------------------------------------

                 Key: CC-1040
                 URL: http://jira.public.thoughtworks.org/browse/CC-1040
             Project: CruiseControl
          Issue Type: Bug
          Components: Core Application
    Affects Versions: 2.8.4
            Reporter: Tobias Liefke
            Priority: Major


The testdetails.xsl is using a template to convert newlines to <br/> to print a nice console output:
  <xsl:template match="text()" mode="newline-to-br">
    <xsl:value-of select="replace(current(), '(\n)|(\r)|(\r\n)', '&lt;br/&gt;')" disable-output-escaping="yes"/>
  </xsl:template>

The problem is, that the special HTML characters like "&" and "<" are not escaped. 
As a result the HTML page will break, if the output contains something like:

"Expected: </div> found: </td>"


Solution: Escape "&" and "<"
  <xsl:template match="text()" mode="newline-to-br">    
    <xsl:value-of select="replace(replace(replace(current(), '&amp;', '&amp;amp;'), '&lt;' , '&amp;lt;'), '(\n)|(\r)|(\r\n)', '&lt;br/&gt;')" disable-output-escaping="yes"/>          
  </xsl:template>   

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.public.thoughtworks.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira

        

------------------------------------------------------------------------------
Benefiting from Server Virtualization: Beyond Initial Workload 
Consolidation -- Increasing the use of server virtualization is a top
priority.Virtualization can reduce costs, simplify management, and improve 
application availability and disaster protection. Learn more about boosting 
the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev