After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 710824 - GnuCash should sanitise UTF-8 before serialising files to avoid writing broken unparseable XML
GnuCash should sanitise UTF-8 before serialising files to avoid writing broke...
Status: RESOLVED FIXED
Product: GnuCash
Classification: Other
Component: Backend - XML
2.4.x
Other Linux
: Normal normal
: ---
Assigned To: gnucash-core-maint
gnucash-core-maint
Depends on:
Blocks:
 
 
Reported: 2013-10-24 17:23 UTC by Paul Fertser
Modified: 2018-06-29 23:20 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description Paul Fertser 2013-10-24 17:23:57 UTC 
There are at least two known occasions of broken unicode strings getting into internal data structures. One happened with specific semicolon-separated CSV files in 2.4.12 (but no longer reproducible on 2.4.13). Another is bug 710823 where GnuCash receives a broken string from libofx.

When this happens, and a user saves his or her gnucash file, it looks like everything is going fine until later he/she doesn't try to load it again only to see an uninformative message and Guile traceback.

I agree GnuCash should properly sanitise its input but I also believe it's necessary to ensure the saved file would be valid XML and loadable even in the presence of some other obscure bugs that are quite possible when you have to communicate to the cruel cold world outside.
Comment 1 John Ralls 2013-12-22 22:36:01 UTC 
This problem has been fixed in the development version (r23598). The fix will be available in the next major software release. Thank you for your bug report.
Comment 2 John Ralls 2017-09-24 22:41:47 UTC 
Reassign version to 2.4.x so that individual 2.4 versions can be retired.
Comment 3 John Ralls 2018-06-29 23:20:25 UTC 
GnuCash bug tracking has moved to a new Bugzilla host. This bug has been copied to https://bugs.gnucash.org/show_bug.cgi?id=710824. Please update any external references or bookmarks.