Preserve illegal XML characters as character references

src/core/src/main/kotlin/org/apache/jmeter/save/JMeterStaxDriver.kt

@@ -17,13 +17,52 @@
 
 package org.apache.jmeter.save
 
+import com.ctc.wstx.api.WstxInputProperties
+import com.ctc.wstx.stax.WstxInputFactory
+import com.ctc.wstx.stax.WstxOutputFactory
 import com.thoughtworks.xstream.io.xml.StaxDriver
+import java.io.InputStream
+import java.io.Reader
+import javax.xml.stream.XMLInputFactory
 import javax.xml.stream.XMLOutputFactory
+import javax.xml.stream.XMLStreamReader
+import javax.xml.transform.Source
+import javax.xml.transform.stream.StreamSource
 
 public class JMeterStaxDriver(
     public val xmlHeader: Boolean = true,
     public val indent: Boolean = true,
 ) : StaxDriver() {
-    override fun createOutputFactory(): XMLOutputFactory =
-        XMLOutputFactoryDelegate(super.createOutputFactory(), xmlHeader = xmlHeader, indent = indent)
+    override fun createOutputFactory(): XMLOutputFactory {
+        // A plugin StAX jar, or a javax.xml.stream.XMLOutputFactory system
+        // property, must not replace Woodstox. Character-reference handling
+        // below is Woodstox-specific.
+        return XMLOutputFactoryDelegate(WstxOutputFactory(), xmlHeader = xmlHeader, indent = indent)
+    }
+
+    override fun createInputFactory(): XMLInputFactory {
+        val factory = WstxInputFactory()
+        factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false)
+        // XML 1.0 documents may still contain the character references JMeter
+        // 5.6.3 wrote for C0 controls (, , ...). NUL, U+FFFE and
+        // U+FFFF stay rejected by Woodstox and are rewritten in createParser.
+        factory.setProperty(WstxInputProperties.P_ALLOW_XML11_ESCAPED_CHARS_IN_XML10, true)
+        return factory
+    }
+
+    override fun createParser(reader: Reader): XMLStreamReader {
+        return XmlCharRefStreamReader(super.createParser(XmlIllegalCharRefReader(reader)))
+    }
+
+    override fun createParser(input: InputStream): XMLStreamReader {
+        return XmlCharRefStreamReader(super.createParser(XmlIllegalCharRefInputStream(input)))
+    }
+
+    override fun createParser(source: Source): XMLStreamReader {
+        if (source is StreamSource) {
+            source.reader?.let { return createParser(it) }
+            source.inputStream?.let { return createParser(it) }
+        }
+        return XmlCharRefStreamReader(super.createParser(source))
+    }
 }

src/core/src/main/kotlin/org/apache/jmeter/save/XMLOutputFactoryDelegate.kt

@@ -19,7 +19,10 @@ package org.apache.jmeter.save
 
 import com.sun.xml.txw2.output.IndentingXMLStreamWriter
 import java.io.OutputStream
+import java.io.OutputStreamWriter
 import java.io.Writer
+import java.nio.charset.Charset
+import java.nio.charset.StandardCharsets
 import javax.xml.stream.XMLEventWriter
 import javax.xml.stream.XMLOutputFactory
 import javax.xml.stream.XMLStreamWriter
@@ -46,9 +49,12 @@ public class XMLOutputFactoryDelegate(
     // Methods that wrap with XMLStreamWriterSkipHeader
 
     private fun XMLStreamWriter.applyXmlStreamWriterConfiguration(): XMLStreamWriter {
-        var result = this
+        // Shield illegal characters before indentation, so both text and
+        // attributes are rewritten. The filter sits under Woodstox and emits
+        // the character reference.
+        var result: XMLStreamWriter = XmlCharRefStreamWriter(this)
         if (indent) {
-            result = IndentingXMLStreamWriter(this)
+            result = IndentingXMLStreamWriter(result)
         }
         if (!xmlHeader) {
             result = XMLStreamWriterSkipHeader(result)
@@ -57,18 +63,27 @@ public class XMLOutputFactoryDelegate(
     }
 
     override fun createXMLStreamWriter(stream: Writer): XMLStreamWriter {
-        return delegate.createXMLStreamWriter(stream).applyXmlStreamWriterConfiguration()
+        return delegate.createXMLStreamWriter(XmlCharRefFilterWriter(stream))
+            .applyXmlStreamWriterConfiguration()
     }
 
     override fun createXMLStreamWriter(stream: OutputStream): XMLStreamWriter {
-        return delegate.createXMLStreamWriter(stream).applyXmlStreamWriterConfiguration()
+        return createXMLStreamWriter(OutputStreamWriter(stream, StandardCharsets.UTF_8))
     }
 
     override fun createXMLStreamWriter(
         stream: OutputStream,
         encoding: String?
     ): XMLStreamWriter {
-        return delegate.createXMLStreamWriter(stream, encoding).applyXmlStreamWriterConfiguration()
+        val charset = charsetOrUtf8(encoding)
+        return createXMLStreamWriter(OutputStreamWriter(stream, charset))
+    }
+
+    private fun charsetOrUtf8(encoding: String?): Charset {
+        if (encoding.isNullOrEmpty()) {
+            return StandardCharsets.UTF_8
+        }
+        return Charset.forName(encoding)
     }
 
     override fun createXMLStreamWriter(result: Result): XMLStreamWriter {