CA-46738: escape email body properly in vmpp alerts

Signed-off-by: Marcus Granado <marcus.granado@eu.citrix.com>

diff --git a/ocaml/xapi/xapi_vmpp.ml b/ocaml/xapi/xapi_vmpp.ml
index 1d71ba48ab40de82b31efa7c49b16a587f37f82a..9ce99ddeb799e877475d4fc3bd3338e60adb09da 100644 (file)
--- a/ocaml/xapi/xapi_vmpp.ml
+++ b/ocaml/xapi/xapi_vmpp.ml
@@ -61,7 +61,13 @@ let create_alert ~__context ~vmpp ~name ~priority ~body ~data =
   assert_licensed ~__context;
   let value = data in
   let msg = 
-    "<message><email>"^body^"</email><data>"^value^"</data></message>"
+               (* value is expected to be valid xml data,
+                  whereas body is not expected to be a valid xml string
+               *)
+    "<message><email>"
+               (* escape any invalid xml string *)
+               ^(Xml.to_string (Xml.PCData body))
+    ^"</email><data>"^value^"</data></message>"
   in
   let successful = priority < 5L in
   if successful