From dfe272cf9795879287063d835cb3bfe283cf80d0 Mon Sep 17 00:00:00 2001
From: Mallory Adams <mallory@avvir.io>
Date: Fri, 21 Jul 2023 14:30:09 -0400
Subject: [PATCH] Add a test to ensure that valid XML is produced by the xunit
 reporter

XML does not allow certain characters to appear in documents. This
failing test demonstrates that one of those characters is not escaped.

This bug means that when a test ends up containing, for example, ANSI
color codes (`&#x1B;[36m&#x3C;div&#x1B;[39m`) then the generated XML
file is invalid and some consumers (such as CircleCI) are unable to
parse the contents.

This commit does not fix the bug, just creates a failing test.

Link: https://www.w3.org/TR/2006/REC-xml11-20060816/#charsets
---
 test/reporters/xunit.spec.js | 39 ++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/test/reporters/xunit.spec.js b/test/reporters/xunit.spec.js
index a5e0f1bbeb..eb8104479d 100644
--- a/test/reporters/xunit.spec.js
+++ b/test/reporters/xunit.spec.js
@@ -357,6 +357,45 @@ describe('XUnit reporter', function () {
         expect(expectedWrite, 'to be', expectedTag);
       });
 
+      it('should write valid XML', function () {
+        var xunit = new XUnit(runner);
+        var inputMessage = '\x1Bsome message';
+        expectedMessage = '�some message';
+        var expectedTest = {
+          state: STATE_FAILED,
+          title: expectedTitle,
+          parent: {
+            fullTitle: function () {
+              return expectedClassName;
+            }
+          },
+          duration: 1000,
+          err: {
+            actual: 'foo',
+            expected: 'bar',
+            message: inputMessage,
+            stack: expectedStack
+          }
+        };
+
+        xunit.test.call(fakeThis, expectedTest);
+        sinon.restore();
+
+        var expectedTag =
+          '<testcase classname="' +
+          expectedClassName +
+          '" name="' +
+          expectedTitle +
+          '" time="1"><failure>' +
+          expectedMessage +
+          '\n' +
+          expectedDiff +
+          '\n' +
+          expectedStack +
+          '</failure></testcase>';
+        expect(expectedWrite, 'to be', expectedTag);
+      });
+
       it('should handle non-string diff values', function () {
         var runner = new EventEmitter();
         createStatsCollector(runner);