From 743f8c526b9d3037bd3a29fa03bde2de11b6e175 Mon Sep 17 00:00:00 2001
From: "Prin.Ing" <267065148+Prin-Ing@users.noreply.github.com>
Date: Sun, 1 Nov 2026 05:40:00 +0000
Subject: [PATCH] Filter invalid XML characters from SVG Dublin Core metadata

Found while testing crates/svg/src/export/output.rs:360 (dublin_core, around line 81)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/svg/src/export/output.rs            |  2 +-
 crates/svg/tests/it/title_control_chars.rs | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/crates/svg/src/export/output.rs b/crates/svg/src/export/output.rs
index 823453a9e..cc7680e90 100644
--- a/crates/svg/src/export/output.rs
+++ b/crates/svg/src/export/output.rs
@@ -357,7 +357,7 @@ impl Writer<'_> {
             line(2, "<rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\">");
             line(3, "<rdf:Description rdf:about=\"\">");
             for (term, value) in dublin_core(self.doc) {
-                line(4, &format!("<dc:{term}>{}</dc:{term}>", xml_escape(&value)));
+                line(4, &format!("<dc:{term}>{}</dc:{term}>", xml_text(&value)));
             }
             line(3, "</rdf:Description>");
             line(2, "</rdf:RDF>");
diff --git a/crates/svg/tests/it/title_control_chars.rs b/crates/svg/tests/it/title_control_chars.rs
index 1dd7fe545..3318ed346 100644
--- a/crates/svg/tests/it/title_control_chars.rs
+++ b/crates/svg/tests/it/title_control_chars.rs
@@ -53,3 +53,19 @@ fn an_artboard_exported_alone_is_titled_after_it() {
     d.artboards[1].name = "\u{1}\u{2}".into();
     assert_eq!(title(&d, alone(Some(1))).as_deref(), Some("<title>Icons</title>"));
 }
+
+#[test]
+fn dublin_core_metadata_control_chars_are_filtered() {
+    let mut d = Document::new(200.0, 200.0);
+    d.title = "Poster\u{b}v2".into();
+    d.metadata.author = "Ann\u{1}e".into();
+    d.metadata.description = "a\u{1}b".into();
+    d.metadata.keywords = vec!["k\u{1}w".into()];
+    d.metadata.copyright_notice = "(c)\u{b}me\u{2}".into();
+    let svg = export(&d, &ExportOptions { metadata: true, ..ExportOptions::default() });
+    assert!(import(&svg).is_ok(), "export wrote invalid XML: {svg}");
+    assert!(svg.contains("<dc:creator>Anne</dc:creator>"));
+    assert!(svg.contains("<dc:title>Poster v2</dc:title>"));
+    assert!(svg.contains("<dc:subject>kw</dc:subject>"));
+    assert!(svg.contains("<dc:rights>(c) me</dc:rights>"));
+}