From ff5cc42ba39b1aa7e27e522e035fd80169ede466 Mon Sep 17 00:00:00 2001
From: Jim Myers <myersjd@umich.edu>
Date: Fri, 8 Feb 2019 13:45:06 -0500
Subject: [PATCH] escape file metadata going to DataCite

Conflicts:
	src/main/java/edu/harvard/iq/dataverse/DOIDataCiteRegisterService.java
---
 .../iq/dataverse/DOIDataCiteRegisterService.java     | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/main/java/edu/harvard/iq/dataverse/DOIDataCiteRegisterService.java b/src/main/java/edu/harvard/iq/dataverse/DOIDataCiteRegisterService.java
index 50f92f81fb5..4b1211590e8 100644
--- a/src/main/java/edu/harvard/iq/dataverse/DOIDataCiteRegisterService.java
+++ b/src/main/java/edu/harvard/iq/dataverse/DOIDataCiteRegisterService.java
@@ -23,6 +23,7 @@
 import javax.persistence.EntityManager;
 import javax.persistence.PersistenceContext;
 import javax.persistence.TypedQuery;
+import org.apache.commons.lang.StringEscapeUtils;
 import org.jsoup.Jsoup;
 import org.jsoup.nodes.Document;
 import org.jsoup.nodes.Element;
@@ -149,7 +150,9 @@ public static String getMetadataFromDvObject(String identifier, Map<String, Stri
         }
         if (dvObject.isInstanceofDataFile()) {
             DataFile df = (DataFile) dvObject;
-            String fileDescription = df.getDescription();
+            //Note: File metadata is not escaped like dataset metadata is, so adding an xml escape here.
+            //This could/should be removed if the datafile methods add escaping
+            String fileDescription = StringEscapeUtils.escapeXml(df.getDescription());
             metadataTemplate.setDescription(fileDescription == null ? "" : fileDescription);
             String datasetPid = df.getOwner().getGlobalId().asString();
             metadataTemplate.setDatasetIdentifier(datasetPid);
@@ -159,7 +162,12 @@ public static String getMetadataFromDvObject(String identifier, Map<String, Stri
 
         metadataTemplate.setContacts(dataset.getLatestVersion().getDatasetContacts());
         metadataTemplate.setProducers(dataset.getLatestVersion().getDatasetProducers());
-        metadataTemplate.setTitle(dvObject.getDisplayName());
+        String title = dvObject.getDisplayName();
+        if(dvObject.isInstanceofDataFile()) {
+            //Note file title is not currently escaped the way the dataset title is, so adding it here.
+            title = StringEscapeUtils.escapeXml(title);
+        }
+        metadataTemplate.setTitle(title);
         String producerString = dataset.getLatestVersion().getRootDataverseNameforCitation();
         if (producerString.isEmpty()) {
             producerString = ":unav";