[WMS Server] metadata not encoded in GetCapabilities

[pspencer@…]

If a WMS Server map file contains metadata to control the title of the map and
layers, and the metadata contains invalid XML characters (specifically the & in
this case), utilities that parse the capabilities document will fail because &
is an invalid character.  For example:

"wms_title" "Rivers & Streams"

will produce:

<title>Rivers & Streams</title>

which will cause xerces to dump on that line.

It is probable that all metadata that ends up in the capabilities document will
have the same problem.

[dmorissette]

The simplefix for this would bo to HTML-encode all metadata values that we
output in Capabilities. There is a single location to change to do that:
msOWSPrintMetadata().

The question is whether that could break existing mapfiles in which all metadata
were already HTML-encoded. OTOH if MapServer doesn't take care of encoding
itself then that opens the possibility of generating broken capabilities
documents as what happens here. So the safe way to go is to have MapServer
HTML-encode all metadata in capabilities, and to document that behavior in the
HOWTOs.

I think I'll run that by the mapserver-dev list before I makethe change though,
just to make sure nobody has a problem with that.

[dmorissette]

Actually, there is already msOWSPrintEncodeMetadata() function, so it's mostly a
matter of walking through all calls to msOWSPrintMetadata() and replacing the
ones that need to be replaced.

[jlacroix]

I've start work on this.

Should I modify WFS code at the same time?

[dmorissette]

Assefa: do you see any problem with Julien updating the WFS code to
automatically encode about everything in capabilities? I told him that it was ok
to do it, so please let us know ASAP if you expect a problem.

[assefa]

I do not see any problem on that.

[jlacroix]

I have put code in 4.3 cvs that encode all metadatas and mapfile parameters when
outputed to a XML document.

I have changed Map Context, WFS, WMS and GML code.

The remaining issues will be in WCS and maybe in SLD code. A new bug have been
opened for both issue.
WCS: Bug 891
SLD: Bug 892