Invalid XML in Icecast statistics output due to lack of escaping (#2255) · Issues · Xiph.Org / Icecast-Server

Invalid XML in Icecast statistics output due to lack of escaping

Icecast version 2.3.3-2ubuntu1.14.04.1 , when reporting statistics via API calls to http://%s:%d/admin/stats.xml, returns this invalid XML:

<icestats>
 <source mount="/radio">
  <Listeners>1</Listeners>
  <listener>
   <IP>23.2.9.2</IP>
   <UserAgent>Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12F70 [FBAN/FBIOS;FBAV/46.0.0.54.156;FBBV/18972819;FBDV/iPhone5,3;FBMD/iPhone;FBSN/iPhone OS;FBSV/8.3;FBSS/2; FBCR/AT&T;FBID/phone;FBLC/en_US;FBOP/5]</UserAgent>
   <Connected>0</Connected>
   <ID>2634887</ID>
  </listener>
 </source>
</icestats>

Note the unescaped &T; which is an undefined XML entity "T", and causes parsers to explode.

Expected behavior: text inside blocks should be html escaped or enclosed in a CDATA block, if I remember my XML correctly.

Originally reported on github by kenrestivo

To upload designs, you'll need to enable LFS. More information