Merge pull request #13 from splitfire-agency/fix/xml-htmlspecialchars

Fix billing xml with html special chars
splitfire-agency · Apr 11, 2023 · f5108f8 · f5108f8
2 parents d9ef267 + 05e31ef
commit f5108f8
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 7 deletions.
diff --git a/src/Services/Billing.php b/src/Services/Billing.php
@@ -322,16 +322,16 @@ public function getXml(): string
       '<?xml version="1.0" encoding="utf-8"?><Billing><Address></Address></Billing>'
     );
     if ($this->companyName) {
-      $dom->Address->addChild("CompanyName", $this->companyName);
+      $dom->Address->addChild("CompanyName", htmlspecialchars($this->companyName));
     }
-    $dom->Address->addChild("FirstName", $this->firstName ?? "xxx");
-    $dom->Address->addChild("LastName", $this->lastName ?? "xxx");
-    $dom->Address->addChild("Address1", $this->address1 ?? "xxx");
+    $dom->Address->addChild("FirstName", htmlspecialchars($this->firstName ?? "xxx"));
+    $dom->Address->addChild("LastName", htmlspecialchars($this->lastName ?? "xxx"));
+    $dom->Address->addChild("Address1", htmlspecialchars($this->address1 ?? "xxx"));
     if ($this->address2) {
-      $dom->Address->addChild("Address2", $this->address2);
+      $dom->Address->addChild("Address2", htmlspecialchars($this->address2));
     }
-    $dom->Address->addChild("ZipCode", $this->zipcode ?? "xxx");
-    $dom->Address->addChild("City", $this->city ?? "xxx");
+    $dom->Address->addChild("ZipCode", htmlspecialchars($this->zipcode ?? "xxx"));
+    $dom->Address->addChild("City", htmlspecialchars($this->city ?? "xxx"));
     $dom->Address->addChild("CountryCode", $this->countryCode ?? 250);
 
     return str_replace(["\n", "\r"], "", $dom->asXML());

diff --git a/tests/Services/BillingTest.php b/tests/Services/BillingTest.php
@@ -30,6 +30,24 @@ public function testValidBillingExportXml()
     );
   }
 
+  /**
+   * Test valid billing export xml
+   */
+  public function testBillingExportXmlWithSpecialChar()
+  {
+    $service = new Billing();
+    $service->setFirstName("John<");
+    $service->setLastName("Doe>");
+    $service->setAddress1("1 & rue d'la paix");
+    $service->setZipCode("75000");
+    $service->setCity("Paris");
+    $service->setCountryCode(250);
+    $this->assertSame(
+      '<?xml version="1.0" encoding="utf-8"?><Billing><Address><FirstName>John&lt;</FirstName><LastName>Doe&gt;</LastName><Address1>1 &amp; rue d\'la paix</Address1><ZipCode>75000</ZipCode><City>Paris</City><CountryCode>250</CountryCode></Address></Billing>',
+      $service->getXml()
+    );
+  }
+
   /**
    * Test empty billing export xml
    */