Invalid response from trashbin api when filename contains invalid unescaped characters

[dpakach]

Steps to reproduce

1. Create a file with & character in its name for eg. strängé filename (duplicate owncloud/ocis-reva#2 &).txt.
2. Delete the file
3. Use Propfind request on trashbin api to get files in trashbin
   curl -X PROPFIND http://localhost:9140/remote.php/dav/trash-bin/<user> -u <user>:<password>

Expected result

The response should contain following content

    <d:response>
        <d:href>/core/remote.php/dav/trash-bin/user1/2147501701/2147501715</d:href>
        <d:propstat>
            <d:prop>
                <oc:trashbin-original-filename>strängé filename (duplicate owncloud/ocis-reva#2 &amp;).txt</oc:trashbin-original-filename>
            </d:prop>
            <d:status>HTTP/1.1 200 OK</d:status>
        </d:propstat>
    </d:response>

Actual result

The response contains following invalid format

    <d:response>
        <d:href>/remote.php/dav/trash-bin/str%C3%A4ng%C3%A9%20filename%20%28duplicate%20%232%20&amp;%29.txt.d1584332791</d:href>
        <d:propstat>
            <d:prop>
                <oc:trashbin-original-filename>strängé filename (duplicate owncloud/ocis-reva#2 &).txt</oc:trashbin-original-filename>
            </d:prop>
            <d:status>HTTP/1.1 200 OK</d:status>
        </d:propstat>
        <d:propstat>
            <d:prop></d:prop>
            <d:status>HTTP/1.1 404 Not Found</d:status>
        </d:propstat>
    </d:response>

diff

    <d:response>
        <d:href>/remote.php/dav/trash-bin/str%C3%A4ng%C3%A9%20filename%20%28duplicate%20%232%20&amp;%29.txt.d1584332791</d:href>
        <d:propstat>
            <d:prop>
-                 <oc:trashbin-original-filename>strängé filename (duplicate owncloud/ocis-reva#2 &).txt</oc:trashbin-original-filename>
+                 <oc:trashbin-original-filename>strängé filename (duplicate owncloud/ocis-reva#2 &amp;).txt</oc:trashbin-original-filename>
            </d:prop>
            <d:status>HTTP/1.1 200 OK</d:status>
        </d:propstat>
        <d:propstat>
            <d:prop></d:prop>
            <d:status>HTTP/1.1 404 Not Found</d:status>
        </d:propstat>
    </d:response>

[refs]

can confirm it still happens in the latest master. XML Renders need to be escaped. Pinging @butonic since a revamp of the entire XML rendering is due date.

[C0rby]

Was fixed.