From a242ebb1d1a4d728c8cd47dc568680ec7fdf7d83 Mon Sep 17 00:00:00 2001
From: ebbit1q <ebbit1q@gmail.com>
Date: Sun, 17 Jan 2021 04:26:18 +0100
Subject: [PATCH] escape some xml values

---
 magic_spoiler/__main__.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/magic_spoiler/__main__.py b/magic_spoiler/__main__.py
index 2c51b167..5f817aba 100644
--- a/magic_spoiler/__main__.py
+++ b/magic_spoiler/__main__.py
@@ -20,6 +20,9 @@ SPOILER_SETS: contextvars.ContextVar = contextvars.ContextVar("SPOILER_SETS")
 
 OUTPUT_DIR = pathlib.Path("out")
 OUTPUT_TMP_DIR = OUTPUT_DIR.joinpath("tmp")
+XML_ESCAPE_TRANSLATE_MAP = str.maketrans(
+    {"&": "&amp;", '"': "&quot;", "<": "&lt;", ">": "&gt;"}
+)
 
 
 def __get_session() -> Union[requests.Session, Any]:
@@ -255,6 +258,10 @@ def close_xml_file(card_xml_file: IO[Any]) -> None:
         f.write(etree.tostring(root, pretty_print=True))
 
 
+def xml_escape(text):
+    return text.translate(XML_ESCAPE_TRANSLATE_MAP)
+
+
 def write_cards(
     card_xml_file: Any, trice_dict: List[Dict[str, Any]], set_code: str
 ) -> None:
@@ -333,6 +340,10 @@ def write_cards(
                     if card["layout"] == "split" or card["layout"] == "aftermath":
                         continue
 
+        set_name, mana_cost, card_cmc, card_type, pow_tough, table_row, text = map(
+            xml_escape,
+            [set_name, mana_cost, card_cmc, card_type, pow_tough, table_row, text],
+        )
         card_xml_file.write("<card>\n")
         card_xml_file.write("<name>" + set_name + "</name>\n")
         card_xml_file.write(