From add5e1e7dde7f32651c1df021ca570fce312b593 Mon Sep 17 00:00:00 2001 From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com> Date: Fri, 23 Oct 2026 20:29:28 +0200 Subject: [PATCH] Reject signed hex digits in XML-ID _xHH_ escapes Found while testing crates/doc/src/xml_id.rs:80 (escaped) Co-Authored-By: Claude Haiku 5.5 Co-Authored-By: Claude Sonnet 5.5 --- crates/doc/src/xml_id.rs | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/crates/doc/src/xml_id.rs b/crates/doc/src/xml_id.rs index db34395d6..ba454de01 100644 --- a/crates/doc/src/xml_id.rs +++ b/crates/doc/src/xml_id.rs @@ -73,7 +73,7 @@ fn escaped(s: &str) -> Option<(char, usize)> { let body = s.strip_prefix("_x")?; let end = body.find('_')?; let hex = body.get(..end)?; - if hex.is_empty() || hex.len() > 6 { + if hex.is_empty() || hex.len() > 6 || !hex.bytes().all(|b| b.is_ascii_hexdigit()) { return None; } let c = char::from_u32(u32::from_str_radix(hex, 16).ok()?)?; @@ -113,6 +113,12 @@ mod tests { assert!(!is_valid("My Rect") && !is_valid("1abc") && !is_valid("")); } + #[test] + fn sign_is_not_a_hex_digit_in_escapes() { + assert_eq!(to_object_name("a_x+41_b"), "a x+41 b"); + assert_eq!(to_object_name("a_x-41_b"), "a x-41 b"); + } + #[test] fn round_trip_names_that_cannot_start_an_xml_name() { for name in ["-abc", ".5 mm", "²x", "Ⅷ", "", "1abc", "Layer 1", " lead", "_a", ":a", "#"] {