{"action":"closed","issue":{"url":"https://api.github.com/repos/adaptivecomputing/torque/issues/318","labels_url":"https://api.github.com/repos/adaptivecomputing/torque/issues/318/labels{/name}","comments_url":"https://api.github.com/repos/adaptivecomputing/torque/issues/318/comments","events_url":"https://api.github.com/repos/adaptivecomputing/torque/issues/318/events","html_url":"https://github.com/adaptivecomputing/torque/issues/318","id":104276833,"number":318,"title":"encode any text written to xml","user":{"login":"stdweird","id":1517606,"avatar_url":"https://avatars.githubusercontent.com/u/1517606?v=3","gravatar_id":"","url":"https://api.github.com/users/stdweird","html_url":"https://github.com/stdweird","followers_url":"https://api.github.com/users/stdweird/followers","following_url":"https://api.github.com/users/stdweird/following{/other_user}","gists_url":"https://api.github.com/users/stdweird/gists{/gist_id}","starred_url":"https://api.github.com/users/stdweird/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stdweird/subscriptions","organizations_url":"https://api.github.com/users/stdweird/orgs","repos_url":"https://api.github.com/users/stdweird/repos","events_url":"https://api.github.com/users/stdweird/events{/privacy}","received_events_url":"https://api.github.com/users/stdweird/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-01T14:19:11Z","updated_at":"2015-09-01T20:11:56Z","closed_at":"2015-09-01T20:11:56Z","body":"job attributes are not encoded when written to xml format. in particular, submitting jobs with `-V` can send lots of user-defined stuff, in particular exported functions (since heartbleed, \r\n```bash\r\nx () {\r\n   echo ok\r\n}\r\nexport -f x\r\n```\r\ngenerates a bash environment variable `BASH_FUNC_x` which contains the function code, which can contain lots of stuff like `&` and `>`.)\r\n\r\na lot of the code uses `xmlNewChild` which specifically states in http://xmlsoft.org/html/libxml-tree.html#xmlNewChild \r\n```\r\nNOTE: @content is supposed to be a piece of XML CDATA, so it allows entity references. XML special chars must be escaped first by using xmlEncodeEntitiesReentrant(), or xmlNewTextChild() should be used.\r\n```\r\n"}}