Fix encoding of MSGID and SD-ID fields of StructuredDataMessage to XML

log4j-api-test/src/test/java/org/apache/logging/log4j/message/StructuredDataMessageTest.java

@@ -73,6 +73,64 @@ void testMsgXml() {
         assertEquals(expected, result);
     }
 
+    @Test
+    void testXmlEncodingOfIdAndType1() {
+        final String id = "i<&d>" + XmlFixture.TEXT;
+        final String type = "t>yp<e&" + XmlFixture.TEXT;
+        final String actualXml =
+                new StructuredDataMessage(id, "discarded message", type).getFormattedMessage(new String[] {"XML"});
+        final String expectedXml = "<StructuredData>\n"
+                + "<type>t&gt;yp&lt;e&amp;" + XmlFixture.ENCODED_TEXT
+                + "</type>\n"
+                + "<id>i&lt;&amp;d&gt;" + XmlFixture.ENCODED_TEXT
+                + "</id>\n"
+                // Following part is encoded by `MapMessage::asXml`, hence, fuzzed & tested elsewhere
+                + "<Map>\n"
+                + "</Map>\n"
+                + "</StructuredData>\n";
+        assertEquals(expectedXml, actualXml);
+    }
+
+    @Test
+    void testXmlEncodingOfIdAndType2() {
+        final String idName = "id&<-name>" + XmlFixture.TEXT;
+        final String idEnterpriseNumber = "id&<-enterprise-number>" + XmlFixture.TEXT;
+        final String[] idRequired = {"id&<-required>" + XmlFixture.TEXT};
+        final String[] idOptional = {"id&<-optional>" + XmlFixture.TEXT};
+        final String type = "t>yp<e&" + XmlFixture.TEXT;
+        final StructuredDataId id =
+                new StructuredDataId(idName, idEnterpriseNumber, idRequired, idOptional, Integer.MAX_VALUE);
+        final String actualXml =
+                new StructuredDataMessage(id, "discarded message", type).getFormattedMessage(new String[] {"XML"});
+        final String expectedXml = "<StructuredData>\n"
+                + "<type>t&gt;yp&lt;e&amp;" + XmlFixture.ENCODED_TEXT
+                + "</type>\n"
+                + "<id>" + "id&amp;&lt;-name&gt;" + XmlFixture.ENCODED_TEXT
+                + "@id&amp;&lt;-enterprise-number&gt;" + XmlFixture.ENCODED_TEXT
+                + "</id>\n"
+                // Following part is encoded by `MapMessage::asXml`, hence, fuzzed & tested elsewhere
+                + "<Map>\n"
+                + "</Map>\n"
+                + "</StructuredData>\n";
+        assertEquals(expectedXml, actualXml);
+    }
+
+    private enum XmlFixture {
+        ;
+
+        private static final String TEXT;
+
+        private static final String ENCODED_TEXT;
+
+        static {
+            final String notBmp = new String(Character.toChars(0x10000));
+            final String invalid = "A\uD800B\uDE00C\0\1\2\3";
+            final String encodedInvalid = "A\uFFFDB\uFFFDC\uFFFD\uFFFD\uFFFD\uFFFD";
+            TEXT = " '\"\t\r\n" + notBmp + invalid;
+            ENCODED_TEXT = " &apos;&quot;\t\r\n" + notBmp + encodedInvalid;
+        }
+    }
+
     @Test
     void testBuilder() {
         final String testMsg = "Test message {}";

log4j-api/src/main/java/org/apache/logging/log4j/message/StructuredDataMessage.java

@@ -356,10 +356,26 @@ public final void asString(final Format format, final StructuredDataId structure
     }
 
     private void asXml(final StructuredDataId structuredDataId, final StringBuilder sb) {
+
         sb.append("<StructuredData>\n");
-        sb.append("<type>").append(type).append("</type>\n");
-        sb.append("<id>").append(structuredDataId).append("</id>\n");
+
+        // Encode type
+        sb.append("<type>");
+        int start = sb.length();
+        sb.append(type);
+        StringBuilders.escapeXml(sb, start);
+        sb.append("</type>\n");
+
+        // Encode ID
+        sb.append("<id>");
+        start = sb.length();
+        structuredDataId.formatTo(sb);
+        StringBuilders.escapeXml(sb, start);
+        sb.append("</id>\n");
+
+        // Encode the rest
         super.asXml(sb);
+
         sb.append("\n</StructuredData>\n");
     }
 

src/changelog/.2.x.x/fix-StructuredDataMessage-XML-encoding.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns="https://logging.apache.org/xml/ns"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xsi:schemaLocation="
+           https://logging.apache.org/xml/ns
+           https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="fixed">
+  <issue id="4136" link="https://github.com/apache/logging-log4j2/pull/4136"/>
+  <description format="asciidoc">
+    Fix encoding of `MSGID` and `SD-ID` fields of `StructuredDataMessage` to XML
+  </description>
+</entry>