Unescape the XML entities in the APPX publisher attribute (#256)

ebourg · Oct 23, 2024 · fb8a6e5 · fb8a6e5
1 parent de54040
commit fb8a6e5
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/jsign-core/pom.xml b/jsign-core/pom.xml
@@ -32,6 +32,12 @@
       <version>2.16.1</version>
     </dependency>
 
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-text</artifactId>
+      <version>1.12.0</version>
+    </dependency>
+
     <dependency>
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-compress</artifactId>

diff --git a/jsign-core/src/main/java/net/jsign/appx/APPXFile.java b/jsign-core/src/main/java/net/jsign/appx/APPXFile.java
@@ -32,6 +32,7 @@
 import javax.security.auth.x500.X500Principal;
 
 import org.apache.commons.io.output.NullOutputStream;
+import org.apache.commons.text.StringEscapeUtils;
 import org.apache.poi.util.IOUtils;
 import org.bouncycastle.asn1.ASN1Object;
 import org.bouncycastle.asn1.DERNull;
@@ -201,7 +202,7 @@ String getPublisher() throws IOException {
 
         Pattern pattern = Pattern.compile("Publisher\\s*=\\s*\"([^\"]+)", Pattern.CASE_INSENSITIVE);
         Matcher matcher = pattern.matcher(manifest);
-        return matcher.find() ? matcher.group(1) : null;
+        return matcher.find() ? StringEscapeUtils.unescapeXml(matcher.group(1)) : null;
     }
 
     @Override