Validate XML numeric character references before string construction

2026-05-19 00:00:46 -04:00 · 2026-03-24 03:55:29 +09:00
parent b959027aa2
commit 1877069780
3 changed files with 40 additions and 1 deletions
@@ -167,6 +167,9 @@ public class XMLTokener extends JSONTokener {
            int cp = (e.charAt(1) == 'x' || e.charAt(1) == 'X')
                ? parseHexEntity(e)
                : parseDecimalEntity(e);
+            if (XML.mustEscape(cp)) {
+                throw new JSONException("Invalid numeric character reference: &#" + e.substring(1) + ";");
+            }
            return new String(new int[] {cp}, 0, 1);
        }
        Character knownEntity = entity.get(e);