Correctly escape xml characters in extensions. fixes #277

gpxpy/gpxfield.py

@@ -16,6 +16,7 @@
 import datetime as mod_datetime
 import re as mod_re
 import copy as mod_copy
+import xml.sax.saxutils as mod_saxutils
 
 from . import utils as mod_utils
 
@@ -400,8 +401,7 @@ def _ETree_to_xml(self, node: Any, nsmap: Dict[str, str]={}, prettyprint: bool=T
             result.append(f' {attrib}="{value}"')
         result.append('>')
         if node.text is not None:
-             result.append(node.text.strip())
-
+            result.append(mod_saxutils.escape(node.text).strip())
 
         # Build subelement nodes
         for child in node:
@@ -412,7 +412,7 @@ def _ETree_to_xml(self, node: Any, nsmap: Dict[str, str]={}, prettyprint: bool=T
         # Add tail and close tag
         tail = node.tail
         if tail is not None:
-            tail = tail.strip()
+            tail = mod_saxutils.escape(tail.strip())
         else:
             tail = ''
         if len(node) > 0:

test.py

@@ -2649,6 +2649,18 @@ def test_xml_chars_encode_decode(self) -> None:
 
         self.assertTrue('<name>Test&lt;a&gt;jkljkl&lt;/gpx&gt;</name>' in gpx_2.to_xml())
 
+    def test_xml_chars_encode_decode_extensions(self) -> None:
+        gpx = mod_gpxpy.gpx.GPX()
+        ext = mod_etree.Element('test')
+        ext.text = "Test<a>jkljkl</gpx>"
+        ext.tail = "<&tail>"
+        gpx.extensions.append(ext)
+        print(gpx.to_xml())
+        gpx_2 = mod_gpxpy.parse(gpx.to_xml())
+        self.assertTrue('<test>Test&lt;a&gt;jkljkl&lt;/gpx&gt;</test>' in gpx_2.to_xml())
+        self.assertTrue('&lt;&amp;tail&gt;' in gpx_2.to_xml())
+
+
     def test_10_to_11_conversion(self) -> None:
         """
         This test checks that reparsing from 1.0 to 1.1 and from 1.1 to 1.0