[Elyahu41]

The issue

ZmanimFormatter.toXML(), ZmanimFormatter.toJSON(), GeoLocation.toXML() and Zman.toXML() write text values exactly as they are, without escaping, so the output is invalid XML or JSON when the text contains special characters.

The edge case

A location name (or a zman label or description) containing a character that is special in XML or JSON:

• XML: &, <, >, " or ', for example Kfar Saba & Ra'anana.
• JSON: ", \ or a control character such as a newline.

Location names often come from user input, a geocoder or a database, so these characters do show up in real data.

What happens

GeoLocation geo = new GeoLocation("Ta\"l & <Ma'alot>", 31.0, 35.0, 0, ZoneId.of("Asia/Jerusalem"));
ZmanimFormatter.toXML(new ComprehensiveZmanimCalendar(geo));
// <Zmanim date="..." ... location="Ta"l & <Ma'alot>" ...>   -> not well-formed: the attribute ends early, a bare & and <
ZmanimFormatter.toJSON(new ComprehensiveZmanimCalendar(geo));
// "location":"Ta"l & <Ma'alot>",                            -> invalid JSON: unescaped quote

Any XML or JSON parser rejects the output, and code that builds an XML / JSON response from it ends up serving a broken document. Text that isn't escaped is also a markup injection point when the location name comes from users.

The fix

• Helpers: Two package-private helpers in ZmanimFormatter:
  • escapeXml: replaces & < > " ' with their entities.
  • escapeJson: escapes " and \ and writes control characters as escape sequences, as RFC 8259 requires.
• Where they're used: Every free-text value in the four methods: location name, calculator name, time zone name and ID, the "other" values, the zman label and description, and the time zone display name in GeoLocation.
• null: Still written as null, as before.

Output for text without special characters is unchanged.

Tests

• toXmlEscapesSpecialCharacters: Parses the output of all three toXML methods with the JDK's XML parser and checks the escaped attribute.
• toJsonEscapesSpecialCharacters: Checks the escaped JSON string, including a newline.

Both fail without the fix.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_015Er4Sx7LnKzzCbgDEatxkU