From: Tom Lane <tgl@sss.pgh.pa.us>
To: Sergiu Ignat <sergiu@bitsoftware.ro>
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: XML element with special characters can be created, serialized,
 but not deserialized
In-reply-to: 
 <CAGtR-15ioG+_jPfZAX2b_YJnOJQSvB1u-sFrctTZ-gQnCZgitw@mail.gmail.com>
References: 
 <CAGtR-15ioG+_jPfZAX2b_YJnOJQSvB1u-sFrctTZ-gQnCZgitw@mail.gmail.com>
Comments: In-reply-to Sergiu Ignat <sergiu@bitsoftware.ro>
	message dated "Tue, 16 May 2023 13:02:20 +0300"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2650677.1684250460.1@sss.pgh.pa.us>
Date: Tue, 16 May 2023 11:21:00 -0400
Message-ID: <2650678.1684250460@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2650678.1684250460%40sss.pgh.pa.us>
Precedence: bulk

Sergiu Ignat <sergiu@bitsoftware.ro> writes:
> I am using PostgreSQL 13.8 and I think that I found an issue with XML
> serialization and deserialization.

Hmm.  The root cause here seems to be that escape_xml() thinks it
doesn't need to escape ASCII control characters, other than CR (\r).
Which is a bit backwards, because after some googling I conclude that
XML 1.1 requires all C0 and C1 control characters to be represented as
numeric escapes *except* CR, LF, and TAB [1].

What we probably ought to do is escape all except LF and TAB.
However, I'm a bit hesitant to back-patch such a behavioral change.
Maybe change this in HEAD (v16) only?

			regards, tom lane

[1] https://www.w3.org/International/questions/qa-controls