Use safer XML escaping #3003
Merged
Use safer XML escaping #3003
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
thanks |
4 tasks
|
Thanks for the quick turnaround here, @jkrems and @boneskull. 👍 This was making hundreds of our CI builds fail today. 😵 |
|
@JamesMGreene Sorry for that & thanks for the report! :) |
|
@boneskull Could you kindly drop a comment here when |
|
published as v3.5.3 |
|
Thank you so much! That threw me for a loop all morning! |
This was referenced Feb 2, 2018
jimthedev
referenced
this pull request
in commitizen/cz-cli
May 24, 2018
This Pull Request updates dependency [mocha](https://github.com/mochajs/mocha) from `v3.1.2` to `v3.5.3` <details> <summary>Release Notes</summary> ### [`v3.5.3`](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md#​353--2017-09-11) [Compare Source](mochajs/mocha@v3.5.2...v3.5.3) #### 🐛 Fixes - [#​3003]: Fix invalid entities in xUnit reporter first appearing in v3.5.1 ([@​jkrems]) [#​3003]: `https://github.com/mochajs/mocha/pull/3003` --- ### [`v3.5.2`](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md#​352--2017-09-10) [Compare Source](mochajs/mocha@v3.5.1...v3.5.2) #### 🐛 Fixes - [#​3001]: Fix AMD-related failures first appearing in v3.5.1 ([@​boneskull]) [#​3001]: `https://github.com/mochajs/mocha/pull/3001` --- ### [`v3.5.1`](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md#​351--2017-09-09) [Compare Source](mochajs/mocha@v3.5.0...v3.5.1) #### 📰 News - 📣 Mocha is now sponsoring [PDXNode](http://pdxnode.org)! If you're in the [Portland](https://wikipedia.org/wiki/Portland,_Oregon) area, come check out the monthly talks and hack nights! #### 🐛 Fixes - [#​2997]: Fix missing `xit` export for "require" interface ([@​solodynamo]) - [#​2957]: Fix unicode character handling in XUnit reporter failures ([@​jkrems]) #### 🔩 Other - [#​2986]: Add issue and PR templates ([@​kungapal]) - [#​2918]: Drop bash dependency for glob-related tests ([@​ScottFreeCode]) - [#​2922]: Improve `--compilers` coverage ([@​ScottFreeCode]) - [#​2981]: Fix tpyos and spelling errors ([@​jsoref]) [#​2997]: `https://github.com/mochajs/mocha/pull/2997` [#​2957]: `https://github.com/mochajs/mocha/pull/2957` [#​2918]: `https://github.com/mochajs/mocha/pull/2918` [#​2986]: `https://github.com/mochajs/mocha/pull/2986` [#​2922]: `https://github.com/mochajs/mocha/pull/2922` [#​2981]: `https://github.com/mochajs/mocha/pull/2981` [@​solodynamo]: https://github.com/solodynamo [@​jkrems]: https://github.com/jkrems [@​jsoref]: https://github.com/jsoref --- ### [`v3.5.0`](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md#​350--2017-07-31) [Compare Source](mochajs/mocha@v3.4.2...v3.5.0) #### 📰 News - Mocha now has a [code of conduct](https://github.com/mochajs/mocha/blob/master/.github/CODE_OF_CONDUCT.md) (thanks [@​kungapal]!). - Old issues and PRs are now being marked "stale" by [Probot's "Stale" plugin](https://github.com/probot/stale). If an issue is marked as such, and you would like to see it remain open, simply add a new comment to the ticket or PR. - **WARNING**: Support for non-ES5-compliant environments will be dropped starting with version 4.0.0 of Mocha! #### 🔒 Security Fixes - [#​2860]: Address [CVE-2015-8315](https://nodesecurity.io/advisories/46) via upgrade of [debug](https://npm.im/debug) ([@​boneskull]) #### 🎉 Enhancements - [#​2696]: Add `--forbid-only` and `--forbid-pending` flags. Use these in CI or hooks to ensure tests aren't accidentally being skipped! ([@​charlierudolph]) - [#​2813]: Support Node.js 8's `--napi-modules` flag ([@​jupp0r]) #### 🔩 Other - Various CI-and-test-related fixes and improvements ([@​boneskull], [@​dasilvacontin], [@​PopradiArpad], [@​Munter], [@​ScottFreeCode]) - "Officially" support Node.js 8 ([@​elergy]) [#​2860]: `https://github.com/mochajs/mocha/pull/2860` [#​2696]: `https://github.com/mochajs/mocha/pull/2696` [#​2813]: `https://github.com/mochajs/mocha/pull/2813` [@​charlierudolph]: https://github.com/charlierudolph [@​PopradiArpad]: https://github.com/PopradiArpad [@​kungapal]: https://github.com/kungapal [@​elergy]: https://github.com/elergy [@​jupp0r]: https://github.com/jupp0r --- ### [`v3.4.2`](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md#​342--2017-05-24) [Compare Source](mochajs/mocha@v3.4.1...v3.4.2) #### 🐛 Fixes - [#​2802]: Remove call to deprecated `os.tmpDir` ([@​makepanic]) - [#​2820]: Eagerly set `process.exitCode` ([@​chrisleck]) #### 🔩 Other - [#​2778]: Move linting into an npm script ([@​Munter]) [@​chrisleck]: https://github.com/chrisleck [@​makepanic]: https://github.com/makepanic [@​Munter]: https://github.com/Munter [#​2778]: `https://github.com/mochajs/mocha/pull/2778` [#​2802]: `https://github.com/mochajs/mocha/issues/2802` [#​2820]: `https://github.com/mochajs/mocha/pull/2820` --- ### [`v3.4.1`](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md#​341--2017-05-14) [Compare Source](mochajs/mocha@v3.3.0...v3.4.1) Fixed a publishing mishap with git's autocrlf settings. --- ### [`v3.3.0`](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md#​330--2017-04-24) [Compare Source](mochajs/mocha@v3.2.0...v3.3.0) Thanks to all our contributors, maintainers, sponsors, and users! ❤️ As highlights: - We've got coverage now! - Testing is looking less flaky \o/. - No more nitpicking about "mocha.js" build on PRs. #### 🎉 Enhancements - [#​2659]: Adds support for loading reporter from an absolute or relative path ([@​sul4bh]) - [#​2769]: Support `--inspect-brk` on command-line ([@​igwejk]) #### 🐛 Fixes - [#​2662]: Replace unicode chars w/ hex codes in HTML reporter ([@​rotemdan]) #### 🔍 Coverage - [#​2672]: Add coverage for node tests ([@​c089], [@​Munter]) - [#​2680]: Increase tests coverage for base reporter ([@​epallerols]) - [#​2690]: Increase tests coverage for doc reporter ([@​craigtaub]) - [#​2701]: Increase tests coverage for landing, min, tap and list reporters ([@​craigtaub]) - [#​2691]: Increase tests coverage for spec + dot reporters ([@​craigtaub]) - [#​2698]: Increase tests coverage for xunit reporter ([@​craigtaub]) - [#​2699]: Increase tests coverage for json-stream, markdown and progress reporters ([@​craigtaub]) - [#​2703]: Cover .some() function in utils.js with tests ([@​seppevs]) - [#​2773]: Add tests for loading reporters w/ relative/absolute paths ([@​sul4bh]) #### 🔩 Other - Remove bin/.eslintrc; ensure execs are linted ([@​boneskull]) - [#​2542]: Expand CONTRIBUTING.md ([@​boneskull]) - [#​2660]: Double timeouts on integration tests ([@​Munter]) - [#​2653]: Update copyright year ([@​Scottkao85], [@​Munter]) - [#​2621]: Update dependencies to enable Greenkeeper ([@​boneskull], [@​greenkeeper]) - [#​2625]: Use trusty container in travis-ci; use "artifacts" addon ([@​boneskull]) - [#​2670]: doc(CONTRIBUTING): fix link to org members ([@​coderbyheart]) - Add Mocha propaganda to README.md ([@​boneskull]) - [#​2470]: Avoid test flake in "delay" test ([@​boneskull]) - [#​2675]: Limit browser concurrency on sauce ([@​boneskull]) - [#​2669]: Use temporary test-only build of mocha.js for browsers tests ([@​Munter]) - Fix "projects" link in README.md ([@​boneskull]) - [#​2678]: Chore(Saucelabs): test on IE9, IE10 and IE11 ([@​coderbyheart]) - [#​2648]: Use `semistandard` directly ([@​kt3k]) - [#​2727]: Make the build reproducible ([@​lamby]) [@​boneskull]: https://github.com/boneskull [@​c089]: https://github.com/c089 [@​coderbyheart]: https://github.com/coderbyheart [@​craigtaub]: https://github.com/craigtaub [@​epallerols]: https://github.com/epallerols [@​greenkeeper]: https://github.com/greenkeeper [@​igwejk]: https://github.com/igwejk [@​kt3k]: https://github.com/kt3k [@​lamby]: https://github.com/lamby [@​Munter]: https://github.com/Munter [@​rotemdan]: https://github.com/rotemdan [@​seppevs]: https://github.com/seppevs [@​sul4bh]: https://github.com/sul4bh [#​2470]: `https://github.com/mochajs/mocha/pull/2470` [#​2542]: `https://github.com/mochajs/mocha/issues/2542` [#​2621]: `https://github.com/mochajs/mocha/pull/2621` [#​2625]: `https://github.com/mochajs/mocha/pull/2625` [#​2648]: `https://github.com/mochajs/mocha/pull/2648` [#​2653]: `https://github.com/mochajs/mocha/pull/2653` [#​2659]: `https://github.com/mochajs/mocha/pull/2659` [#​2660]: `https://github.com/mochajs/mocha/pull/2660` [#​2662]: `https://github.com/mochajs/mocha/pull/2662` [#​2669]: `https://github.com/mochajs/mocha/pull/2669` [#​2670]: `https://github.com/mochajs/mocha/pull/2670` [#​2672]: `https://github.com/mochajs/mocha/pull/2672` [#​2675]: `https://github.com/mochajs/mocha/pull/2675` [#​2678]: `https://github.com/mochajs/mocha/pull/2678` [#​2680]: `https://github.com/mochajs/mocha/pull/2680` [#​2690]: `https://github.com/mochajs/mocha/pull/2690` [#​2691]: `https://github.com/mochajs/mocha/pull/2691` [#​2698]: `https://github.com/mochajs/mocha/pull/2698` [#​2699]: `https://github.com/mochajs/mocha/pull/2699` [#​2701]: `https://github.com/mochajs/mocha/pull/2701` [#​2703]: `https://github.com/mochajs/mocha/pull/2703` [#​2727]: `https://github.com/mochajs/mocha/pull/2727` [#​2769]: `https://github.com/mochajs/mocha/pull/2769` [#​2773]: `https://github.com/mochajs/mocha/pull/2773` --- ### [`v3.2.0`](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md#​320--2016-11-24) [Compare Source](mochajs/mocha@v3.1.2...v3.2.0) #### 📰 News ##### Mocha is now a JS Foundation Project! Mocha is proud to have joined the [JS Foundation](https://js.foundation). For more information, [read the announcement](https://js.foundation/announcements/2016/10/17/Linux-Foundation-Unites-JavaScript-Community-Open-Web-Development/). ##### Contributor License Agreement Under the foundation, all contributors to Mocha must sign the [JS Foundation CLA](https://js.foundation/CLA/) before their code can be merged. When sending a PR--if you have not already signed the CLA--a friendly bot will ask you to do so. Mocha remains licensed under the [MIT license](https://github.com/mochajs/mocha/blob/master/LICENSE). #### 🐛 Bug Fix - [#​2535]: Fix crash when `--watch` encounters broken symlinks ([@​villesau]) - [#​2593]: Fix (old) regression; incorrect symbol shown in `list` reporter ([@​Aldaviva]) - [#​2584]: Fix potential error when running XUnit reporter ([@​vobujs]) #### 🎉 Enhancement - [#​2294]: Improve timeout error messaging ([@​jeversmann], [@​boneskull]) - [#​2520]: Add info about `--inspect` flag to CLI help ([@​ughitsaaron]) #### 🔩 Other - [#​2570]: Use [karma-mocha](https://npmjs.com/package/karma-mocha) proper ([@​boneskull]) - Licenses updated to reflect new copyright, add link to license and browser matrix to `README.md` ([@​boneskull], [@​ScottFreeCode], [@​dasilvacontin]) [#​2294]: `https://github.com/mochajs/mocha/issues/2294` [#​2535]: `https://github.com/mochajs/mocha/issues/2535` [#​2520]: `https://github.com/mochajs/mocha/pull/2520` [#​2593]: `https://github.com/mochajs/mocha/pull/2593` [#​2584]: `https://github.com/mochajs/mocha/issues/2584` [#​2570]: `https://github.com/mochajs/mocha/issues/2570` [@​Aldaviva]: https://github.com/Aldaviva [@​jeversmann]: https://github.com/jeversmann [@​ughitsaaron]: https://github.com/ughitsaaron [@​villesau]: https://github.com/villesau [@​vobujs]: https://github.com/vobujs Thanks to all our contributors, sponsors and backers! Keep on the lookout for a public roadmap and new contribution guide coming soon. --- </details> --- This PR has been generated by [Renovate Bot](https://renovatebot.com).
This was referenced Sep 22, 2018
1 task
This was referenced Dec 6, 2018
This was referenced Dec 8, 2018
This was referenced Dec 23, 2018
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of the Change
Fixes a regression introduced in #2957. It was too aggressive in its use of named escapes which broke XML files that might not support all of the named escapes available in HTML.
Alternate Designs
We could try to get support for safe named escapes into
he. But given that this won't affect the visible output, I focussed on fixing the functionality first.Why should this be in core?
Benefits
Possible Drawbacks
This makes the HTML output a bit uglier. E.g. it won't use the nice
"anymore.Applicable issues