From 0bd01adf2e5846d5e5450f3f45103c78c1bff6d0 Mon Sep 17 00:00:00 2001
From: Jim Myers <myersjd@umich.edu>
Date: Tue, 13 Apr 2021 16:55:37 -0400
Subject: [PATCH] Escape description for use in datacite xml (file and datacite
 api call)

---
 .../edu/harvard/iq/dataverse/DOIDataCiteRegisterService.java | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/main/java/edu/harvard/iq/dataverse/DOIDataCiteRegisterService.java b/src/main/java/edu/harvard/iq/dataverse/DOIDataCiteRegisterService.java
index 815733f1b7b..ce32c18fa7a 100644
--- a/src/main/java/edu/harvard/iq/dataverse/DOIDataCiteRegisterService.java
+++ b/src/main/java/edu/harvard/iq/dataverse/DOIDataCiteRegisterService.java
@@ -5,7 +5,6 @@
  */
 package edu.harvard.iq.dataverse;
 
-import edu.harvard.iq.dataverse.AbstractGlobalIdServiceBean.GlobalIdMetadataTemplate;
 import edu.harvard.iq.dataverse.branding.BrandingUtil;
 
 import java.io.ByteArrayOutputStream;
@@ -21,7 +20,6 @@
 import java.util.logging.Logger;
 import javax.ejb.EJB;
 import javax.ejb.Stateless;
-import javax.inject.Inject;
 import javax.persistence.EntityManager;
 import javax.persistence.PersistenceContext;
 import javax.persistence.TypedQuery;
@@ -176,7 +174,8 @@ public static String getMetadataFromDvObject(String identifier, Map<String, Stri
         metadataTemplate.setCreators(Util.getListFromStr(metadata.get("datacite.creator")));
         metadataTemplate.setAuthors(dataset.getLatestVersion().getDatasetAuthors());
         if (dvObject.isInstanceofDataset()) {
-            String description = dataset.getLatestVersion().getDescriptionPlainText();
+            //While getDescriptionPlainText strips < and > from HTML, it leaves '&' (at least so we need to xml escape as well
+            String description = StringEscapeUtils.escapeXml(dataset.getLatestVersion().getDescriptionPlainText());
             if (description.isEmpty() || description.equals(DatasetField.NA_VALUE)) {
                 description = AbstractGlobalIdServiceBean.UNAVAILABLE;
             }