From 474e48bbd2b45e3c40734ffa7f2f1b557ef4e5d5 Mon Sep 17 00:00:00 2001
From: Scott Barta <sbarta@google.com>
Date: Mon, 1 Jul 2013 16:33:44 -0700
Subject: Escaping for pathnames in template XML files

Does proper XML escaping in Freemarker XML templates to
avoid problems with pathnames that contain XML-sensitive
characters.

Change-Id: I1f191ccabd0c81af821c7bbdf88bbb23ba42ff9c
---
 templates/activities/BlankActivity/recipe.xml.ftl  | 32 +++++++++++-----------
 .../activities/FullscreenActivity/recipe.xml.ftl   | 24 ++++++++--------
 templates/activities/LoginActivity/recipe.xml.ftl  | 16 +++++------
 .../activities/MasterDetailFlow/recipe.xml.ftl     | 26 +++++++++---------
 .../activities/SettingsActivity/recipe.xml.ftl     | 16 +++++------
 5 files changed, 57 insertions(+), 57 deletions(-)

(limited to 'templates/activities')

diff --git a/templates/activities/BlankActivity/recipe.xml.ftl b/templates/activities/BlankActivity/recipe.xml.ftl
index 148b09d..1889cdc 100644
--- a/templates/activities/BlankActivity/recipe.xml.ftl
+++ b/templates/activities/BlankActivity/recipe.xml.ftl
@@ -1,57 +1,57 @@
 <?xml version="1.0"?>
 <recipe>
     <merge from="AndroidManifest.xml.ftl"
-             to="${manifestOut}/AndroidManifest.xml" />
+             to="${escapeXmlAttribute(manifestOut)}/AndroidManifest.xml" />
 
     <instantiate from="res/menu/main.xml.ftl"
-            to="${resOut}/menu/${menuName}.xml" />
+            to="${escapeXmlAttribute(resOut)}/menu/${menuName}.xml" />
 
     <merge from="res/values/strings.xml.ftl"
-             to="${resOut}/values/strings.xml" />
+             to="${escapeXmlAttribute(resOut)}/values/strings.xml" />
 
     <merge from="res/values/dimens.xml"
-             to="${resOut}/values/dimens.xml" />
+             to="${escapeXmlAttribute(resOut)}/values/dimens.xml" />
     <merge from="res/values-sw600dp/dimens.xml"
-             to="${resOut}/values-sw600dp/dimens.xml" />
+             to="${escapeXmlAttribute(resOut)}/values-sw600dp/dimens.xml" />
     <merge from="res/values-sw720dp-land/dimens.xml"
-             to="${resOut}/values-sw720dp-land/dimens.xml" />
+             to="${escapeXmlAttribute(resOut)}/values-sw720dp-land/dimens.xml" />
 
     <!-- Decide what kind of layout to add (viewpager or not) -->
     <#if navType?contains("pager")>
         <instantiate from="res/layout/activity_pager.xml.ftl"
-                       to="${resOut}/layout/${layoutName}.xml" />
+                       to="${escapeXmlAttribute(resOut)}/layout/${layoutName}.xml" />
         <instantiate from="res/layout/fragment_dummy.xml.ftl"
-                       to="${resOut}/layout/fragment_${classToResource(activityClass)}_dummy.xml" />
+                       to="${escapeXmlAttribute(resOut)}/layout/fragment_${classToResource(activityClass)}_dummy.xml" />
 
     <#elseif navType == "tabs" || navType == "dropdown">
         <instantiate from="res/layout/activity_fragment_container.xml"
-                       to="${resOut}/layout/${layoutName}.xml" />
+                       to="${escapeXmlAttribute(resOut)}/layout/${layoutName}.xml" />
         <instantiate from="res/layout/fragment_dummy.xml.ftl"
-                       to="${resOut}/layout/fragment_${classToResource(activityClass)}_dummy.xml" />
+                       to="${escapeXmlAttribute(resOut)}/layout/fragment_${classToResource(activityClass)}_dummy.xml" />
 
     <#else>
         <instantiate from="res/layout/activity_simple.xml.ftl"
-                       to="${resOut}/layout/${layoutName}.xml" />
+                       to="${escapeXmlAttribute(resOut)}/layout/${layoutName}.xml" />
     </#if>
 
     <!-- Decide which activity code to add -->
     <#if navType == "none">
         <instantiate from="src/app_package/SimpleActivity.java.ftl"
-                       to="${srcOut}/${activityClass}.java" />
+                       to="${escapeXmlAttribute(srcOut)}/${activityClass}.java" />
 
     <#elseif navType == "tabs_pager" || navType == "pager_strip">
         <instantiate from="src/app_package/TabsAndPagerActivity.java.ftl"
-                       to="${srcOut}/${activityClass}.java" />
+                       to="${escapeXmlAttribute(srcOut)}/${activityClass}.java" />
 
     <#elseif navType == "tabs">
         <instantiate from="src/app_package/TabsActivity.java.ftl"
-                       to="${srcOut}/${activityClass}.java" />
+                       to="${escapeXmlAttribute(srcOut)}/${activityClass}.java" />
 
     <#elseif navType == "dropdown">
         <instantiate from="src/app_package/DropdownActivity.java.ftl"
-                       to="${srcOut}/${activityClass}.java" />
+                       to="${escapeXmlAttribute(srcOut)}/${activityClass}.java" />
 
     </#if>
 
-    <open file="${resOut}/layout/${layoutName}.xml" />
+    <open file="${escapeXmlAttribute(resOut)}/layout/${layoutName}.xml" />
 </recipe>
diff --git a/templates/activities/FullscreenActivity/recipe.xml.ftl b/templates/activities/FullscreenActivity/recipe.xml.ftl
index b3e1f20..6f121a8 100644
--- a/templates/activities/FullscreenActivity/recipe.xml.ftl
+++ b/templates/activities/FullscreenActivity/recipe.xml.ftl
@@ -1,30 +1,30 @@
 <?xml version="1.0"?>
 <recipe>
     <merge from="AndroidManifest.xml.ftl"
-             to="${manifestOut}/AndroidManifest.xml" />
+             to="${escapeXmlAttribute(manifestOut)}/AndroidManifest.xml" />
 
     <merge from="res/values/attrs.xml"
-             to="${resOut}/values/attrs.xml" />
+             to="${escapeXmlAttribute(resOut)}/values/attrs.xml" />
     <merge from="res/values/colors.xml"
-             to="${resOut}/values/colors.xml" />
+             to="${escapeXmlAttribute(resOut)}/values/colors.xml" />
     <merge from="res/values/styles.xml"
-              to="${resOut}/values/styles.xml" />
+              to="${escapeXmlAttribute(resOut)}/values/styles.xml" />
     <merge from="res/values-v11/styles.xml"
-             to="${resOut}/values-v11/styles.xml" />
+             to="${escapeXmlAttribute(resOut)}/values-v11/styles.xml" />
     <instantiate from="res/layout/activity_fullscreen.xml.ftl"
-                   to="${resOut}/layout/${layoutName}.xml" />
+                   to="${escapeXmlAttribute(resOut)}/layout/${layoutName}.xml" />
 
     <merge from="res/values/strings.xml.ftl"
-             to="${resOut}/values/strings.xml" />
+             to="${escapeXmlAttribute(resOut)}/values/strings.xml" />
 
     <instantiate from="src/app_package/FullscreenActivity.java.ftl"
-                   to="${srcOut}/${activityClass}.java" />
+                   to="${escapeXmlAttribute(srcOut)}/${activityClass}.java" />
     <instantiate from="src/app_package/util/SystemUiHider.java.ftl"
-                   to="${srcOut}/util/SystemUiHider.java" />
+                   to="${escapeXmlAttribute(srcOut)}/util/SystemUiHider.java" />
     <instantiate from="src/app_package/util/SystemUiHiderBase.java.ftl"
-                   to="${srcOut}/util/SystemUiHiderBase.java" />
+                   to="${escapeXmlAttribute(srcOut)}/util/SystemUiHiderBase.java" />
     <instantiate from="src/app_package/util/SystemUiHiderHoneycomb.java.ftl"
-                   to="${srcOut}/util/SystemUiHiderHoneycomb.java" />
+                   to="${escapeXmlAttribute(srcOut)}/util/SystemUiHiderHoneycomb.java" />
 
-    <open file="${resOut}/layout/${layoutName}.xml" />
+    <open file="${escapeXmlAttribute(resOut)}/layout/${layoutName}.xml" />
 </recipe>
diff --git a/templates/activities/LoginActivity/recipe.xml.ftl b/templates/activities/LoginActivity/recipe.xml.ftl
index 58d823f..94f93d6 100644
--- a/templates/activities/LoginActivity/recipe.xml.ftl
+++ b/templates/activities/LoginActivity/recipe.xml.ftl
@@ -1,22 +1,22 @@
 <?xml version="1.0"?>
 <recipe>
     <merge from="AndroidManifest.xml.ftl"
-             to="${manifestOut}/AndroidManifest.xml" />
+             to="${escapeXmlAttribute(manifestOut)}/AndroidManifest.xml" />
 
     <merge from="res/values/styles.xml"
-             to="${resOut}/values/styles.xml" />
+             to="${escapeXmlAttribute(resOut)}/values/styles.xml" />
     <merge from="res/values-large/styles.xml"
-             to="${resOut}/values-large/styles.xml" />
+             to="${escapeXmlAttribute(resOut)}/values-large/styles.xml" />
     <copy from="res/menu/activity_login.xml"
-            to="${resOut}/menu/${menuName}.xml" />
+            to="${escapeXmlAttribute(resOut)}/menu/${menuName}.xml" />
     <instantiate from="res/layout/activity_login.xml.ftl"
-                   to="${resOut}/layout/${layoutName}.xml" />
+                   to="${escapeXmlAttribute(resOut)}/layout/${layoutName}.xml" />
 
     <instantiate from="res/values/strings.xml.ftl"
-                   to="${resOut}/values/strings_${simpleName}.xml" />
+                   to="${escapeXmlAttribute(resOut)}/values/strings_${simpleName}.xml" />
 
     <instantiate from="src/app_package/LoginActivity.java.ftl"
-                   to="${srcOut}/${activityClass}.java" />
+                   to="${escapeXmlAttribute(srcOut)}/${activityClass}.java" />
 
-    <open file="${resOut}/layout/${layoutName}.xml" />
+    <open file="${escapeXmlAttribute(resOut)}/layout/${layoutName}.xml" />
 </recipe>
diff --git a/templates/activities/MasterDetailFlow/recipe.xml.ftl b/templates/activities/MasterDetailFlow/recipe.xml.ftl
index c06e517..4b39f74 100644
--- a/templates/activities/MasterDetailFlow/recipe.xml.ftl
+++ b/templates/activities/MasterDetailFlow/recipe.xml.ftl
@@ -1,32 +1,32 @@
 <?xml version="1.0"?>
 <recipe>
     <merge from="AndroidManifest.xml.ftl"
-             to="${manifestOut}/AndroidManifest.xml" />
+             to="${escapeXmlAttribute(manifestOut)}/AndroidManifest.xml" />
 
     <merge from="res/values-large/refs.xml.ftl"
-             to="${resOut}/values-large/refs.xml" />
+             to="${escapeXmlAttribute(resOut)}/values-large/refs.xml" />
     <merge from="res/values-sw600dp/refs.xml.ftl"
-             to="${resOut}/values-sw600dp/refs.xml" />
+             to="${escapeXmlAttribute(resOut)}/values-sw600dp/refs.xml" />
     <merge from="res/values/strings.xml.ftl"
-             to="${resOut}/values/strings.xml" />
+             to="${escapeXmlAttribute(resOut)}/values/strings.xml" />
 
     <instantiate from="res/layout/activity_content_detail.xml.ftl"
-                   to="${resOut}/layout/activity_${detail_name}.xml" />
+                   to="${escapeXmlAttribute(resOut)}/layout/activity_${detail_name}.xml" />
     <instantiate from="res/layout/activity_content_list.xml.ftl"
-                   to="${resOut}/layout/activity_${collection_name}.xml" />
+                   to="${escapeXmlAttribute(resOut)}/layout/activity_${collection_name}.xml" />
     <instantiate from="res/layout/activity_content_twopane.xml.ftl"
-                   to="${resOut}/layout/activity_${extractLetters(objectKind?lower_case)}_twopane.xml" />
+                   to="${escapeXmlAttribute(resOut)}/layout/activity_${extractLetters(objectKind?lower_case)}_twopane.xml" />
     <instantiate from="res/layout/fragment_content_detail.xml.ftl"
-                   to="${resOut}/layout/fragment_${detail_name}.xml" />
+                   to="${escapeXmlAttribute(resOut)}/layout/fragment_${detail_name}.xml" />
 
     <instantiate from="src/app_package/ContentDetailActivity.java.ftl"
-                   to="${srcOut}/${DetailName}Activity.java" />
+                   to="${escapeXmlAttribute(srcOut)}/${DetailName}Activity.java" />
     <instantiate from="src/app_package/ContentDetailFragment.java.ftl"
-                   to="${srcOut}/${DetailName}Fragment.java" />
+                   to="${escapeXmlAttribute(srcOut)}/${DetailName}Fragment.java" />
     <instantiate from="src/app_package/ContentListActivity.java.ftl"
-                   to="${srcOut}/${CollectionName}Activity.java" />
+                   to="${escapeXmlAttribute(srcOut)}/${CollectionName}Activity.java" />
     <instantiate from="src/app_package/ContentListFragment.java.ftl"
-                   to="${srcOut}/${CollectionName}Fragment.java" />
+                   to="${escapeXmlAttribute(srcOut)}/${CollectionName}Fragment.java" />
     <instantiate from="src/app_package/dummy/DummyContent.java.ftl"
-                   to="${srcOut}/dummy/DummyContent.java" />
+                   to="${escapeXmlAttribute(srcOut)}/dummy/DummyContent.java" />
 </recipe>
diff --git a/templates/activities/SettingsActivity/recipe.xml.ftl b/templates/activities/SettingsActivity/recipe.xml.ftl
index 6f68147..b6d46ce 100644
--- a/templates/activities/SettingsActivity/recipe.xml.ftl
+++ b/templates/activities/SettingsActivity/recipe.xml.ftl
@@ -1,22 +1,22 @@
 <?xml version="1.0"?>
 <recipe>
     <merge from="AndroidManifest.xml.ftl"
-             to="${manifestOut}/AndroidManifest.xml" />
+             to="${escapeXmlAttribute(manifestOut)}/AndroidManifest.xml" />
 
     <copy from="res/xml/pref_data_sync.xml"
-            to="${resOut}/xml/pref_data_sync.xml" />
+            to="${escapeXmlAttribute(resOut)}/xml/pref_data_sync.xml" />
     <copy from="res/xml/pref_general.xml"
-            to="${resOut}/xml/pref_general.xml" />
+            to="${escapeXmlAttribute(resOut)}/xml/pref_general.xml" />
     <merge from="res/xml/pref_headers.xml.ftl"
-             to="${resOut}/xml/pref_headers.xml" />
+             to="${escapeXmlAttribute(resOut)}/xml/pref_headers.xml" />
     <copy from="res/xml/pref_notification.xml"
-            to="${resOut}/xml/pref_notification.xml" />
+            to="${escapeXmlAttribute(resOut)}/xml/pref_notification.xml" />
 
     <instantiate from="res/values/strings.xml.ftl"
-                   to="${resOut}/values/strings_${simpleName}.xml" />
+                   to="${escapeXmlAttribute(resOut)}/values/strings_${simpleName}.xml" />
 
     <instantiate from="src/app_package/SettingsActivity.java.ftl"
-                   to="${srcOut}/${activityClass}.java" />
+                   to="${escapeXmlAttribute(srcOut)}/${activityClass}.java" />
 
-    <open file="${srcOut}/${activityClass}.java" />
+    <open file="${escapeXmlAttribute(srcOut)}/${activityClass}.java" />
 </recipe>
-- 
cgit v1.1