Merge remote-tracking branch 'origin/MC-34617' into 2.4-develop-pr27

Author: serhii-balko

app/code/Magento/Sitemap/Model/Sitemap.php

@@ -571,22 +571,36 @@ protected function _getSitemapRow($url, $lastmod = null, $changefreq = null, $pr
             foreach ($images->getCollection() as $image) {
                 $row .= '<image:image>';
                 $row .= '<image:loc>' . $this->_escaper->escapeUrl($image->getUrl()) . '</image:loc>';
-                $row .= '<image:title>' . $this->_escaper->escapeHtml($images->getTitle()) . '</image:title>';
+                $row .= '<image:title>' . $this->escapeXmlText($images->getTitle()) . '</image:title>';
                 if ($image->getCaption()) {
-                    $row .= '<image:caption>' . $this->_escaper->escapeHtml($image->getCaption()) . '</image:caption>';
+                    $row .= '<image:caption>' . $this->escapeXmlText($image->getCaption()) . '</image:caption>';
                 }
                 $row .= '</image:image>';
             }
             // Add PageMap image for Google web search
             $row .= '<PageMap xmlns="http://www.google.com/schemas/sitemap-pagemap/1.0"><DataObject type="thumbnail">';
-            $row .= '<Attribute name="name" value="' . $this->_escaper->escapeHtml($images->getTitle()) . '"/>';
+            $row .= '<Attribute name="name" value="' . $this->_escaper->escapeHtmlAttr($images->getTitle()) . '"/>';
             $row .= '<Attribute name="src" value="' . $this->_escaper->escapeUrl($images->getThumbnail()) . '"/>';
             $row .= '</DataObject></PageMap>';
         }
 
         return '<url>' . $row . '</url>';
     }
 
+    /**
+     * Escape string for XML context.
+     *
+     * @param string $text
+     * @return string
+     */
+    private function escapeXmlText(string $text): string
+    {
+        $doc = new \DOMDocument('1.0', 'UTF-8');
+        $fragment = $doc->createDocumentFragment();
+        $fragment->appendChild($doc->createTextNode($text));
+        return $doc->saveXML($fragment);
+    }
+
     /**
      * Get sitemap index row
      *

app/code/Magento/Sitemap/Test/Unit/Model/SitemapTest.php

@@ -15,6 +15,8 @@
 use Magento\Framework\Filesystem\Directory\Write as DirectoryWrite;
 use Magento\Framework\Filesystem\File\Write;
 use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
+use Magento\Framework\Translate\InlineInterface;
+use Magento\Framework\ZendEscaper;
 use Magento\Sitemap\Helper\Data;
 use Magento\Sitemap\Model\ItemProvider\ConfigReaderInterface;
 use Magento\Sitemap\Model\ItemProvider\ItemProviderInterface;
@@ -551,7 +553,7 @@ protected function getModelMock($mockBeforeSave = false)
                                     new DataObject(
                                         [
                                             'url' => $storeBaseMediaUrl . 'i/m/image1.png',
-                                            'caption' => 'caption & > title < "'
+                                            'caption' => 'Copyright © caption &trade; & > title < "'
                                         ]
                                     ),
                                     new DataObject(
@@ -610,7 +612,8 @@ private function getModelConstructorArgs()
 
         $objectManager = new ObjectManager($this);
         $escaper = $objectManager->getObject(Escaper::class);
-
+        $this->setPrivatePropertyValue($escaper, 'escaper', $objectManager->getObject(ZendEscaper::class));
+        $this->setPrivatePropertyValue($escaper, 'translateInline', $this->createMock(InlineInterface::class));
         $constructArguments = $objectManager->getConstructArguments(
             Sitemap::class,
             [
@@ -796,4 +799,21 @@ public function getDocumentRootFromBaseDirUrlDataProvider(): array
             ],
         ];
     }
+
+    /**
+     * @param mixed $object
+     * @param string $attributeName
+     * @param string $value
+     */
+    private function setPrivatePropertyValue($object, $attributeName, $value): void
+    {
+        $attribute = new \ReflectionProperty($object, $attributeName);
+        if ($attribute->isPublic()) {
+            $object->$attributeName = $value;
+        } else {
+            $attribute->setAccessible(true);
+            $attribute->setValue($object, $value);
+            $attribute->setAccessible(false);
+        }
+    }
 }

app/code/Magento/Sitemap/Test/Unit/Model/_files/sitemap-1-4.xml

@@ -15,7 +15,7 @@
         <image:image>
             <image:loc>http://store.com/pub/media/catalog/product/cache/c9e0b0ef589f3508e5ba515cde53c5ff/i/m/image1.png</image:loc>
             <image:title>Product &amp; &gt; title &lt; &quot;</image:title>
-            <image:caption>caption &amp; &gt; title &lt; &quot;</image:caption>
+            <image:caption>Copyright &#xa9; caption &amp;trade; &amp; &gt; title &lt; &quot;</image:caption>
         </image:image>
         <image:image>
             <image:loc>http://store.com/pub/media/catalog/product/cache/c9e0b0ef589f3508e5ba515cde53c5ff/i/m/image_no_caption.png</image:loc>

app/code/Magento/Sitemap/Test/Unit/Model/_files/sitemap-single.xml

@@ -33,7 +33,7 @@
         <image:image>
             <image:loc>http://store.com/pub/media/catalog/product/cache/c9e0b0ef589f3508e5ba515cde53c5ff/i/m/image1.png</image:loc>
             <image:title>Product &amp; &gt; title &lt; &quot;</image:title>
-            <image:caption>caption &amp; &gt; title &lt; &quot;</image:caption>
+            <image:caption>Copyright &#xa9; caption &amp;trade; &amp; &gt; title &lt; &quot;</image:caption>
         </image:image>
         <image:image>
             <image:loc>http://store.com/pub/media/catalog/product/cache/c9e0b0ef589f3508e5ba515cde53c5ff/i/m/image_no_caption.png</image:loc>