Joshua Nussbaum

Inappropriate encoding for output context in the `XmlBuilder` module allows for Content Spoofing and Cross-site Scripting (XSS). The issue resides in the `lib/xml builder.ex` file and affects the `XmlBuilder.generate/1()`, `XmlBuilder.generate/2()`, `XmlBuilder.escape string/1()`, and `XmlBuilder.escape entity/1()` routines. Specifically, `XmlBuilder.generate/1()` fails to escape literal `&` characters in text or attribute values when they are followed by entity-like tokens such as `lt;`, `gt;`, `amp;`, `quot;`, or `apos;`. This allows attacker-supplied input to be emitted verbatim into the serialized XML. When a downstream XML parser processes the document, it decodes these sequences into literal characters, enabling the injection of markup into consumers that render the content in markup-sensitive contexts like HTML, SVG, or RSS/Atom feeds.

An XML Injection issue in the `XmlBuilder` module allows for Content Spoofing and XML Injection. The problem exists within the `lib/xml builder.ex` file and affects the `XmlBuilder.generate/1()`, `XmlBuilder.generate/2()`, and `XmlBuilder.escape/1()` functions. Specifically, the `escape/1()` function handles `{:cdata, data}` by concatenating data between CDATA markers without checking for the `]]>` sequence. Since CDATA sections lack an internal escape mechanism, an attacker providing input containing `]]>` can prematurely close the CDATA section. This allows subsequent bytes to be interpreted as ordinary XML markup, enabling the injection of arbitrary elements, text, or entity references into the resulting document.

An XML Injection issue in the XmlBuilder module allows for Content Spoofing and XML Injection. The problem occurs because element names, attribute names, and doctype identifiers are interpolated directly into the serialized XML output without validation or escaping of structural characters such as <, >, ", ', and &. An attacker capable of influencing a name argument—such as an element name derived from an HTTP form field or a JSON object key—can inject arbitrary XML markup, including comments, extra elements, and event-handler attributes. This issue is associated with the file lib/xml builder.ex and the functions `XmlBuilder.generate/1()`, `XmlBuilder.generate/2()`, `XmlBuilder.element/1()`, `XmlBuilder.element/2()`, and `XmlBuilder.element/3()`.