Cobertura XML is malformed: unescaped quotes in filename string

[DLehenbauer]

• Version: v12.18.3
• Platform: Linux d35e72cef690 5.4.72-microsoft-standard-WSL2 #1 SMP Wed Oct 28 23:40:43 UTC 2020 x86_64 GNU/Linux

I'm guessing this is a trivial matter of needing to escapify filenames, but am happy to help produce a minimal repro if it would be helpful.

The malformed XML is an unquoted string that occurs when our coverage run includes a webpack'ed bundle that references react as an external module:

<class name="external &quot;react&quot;" filename="../../@fluid-experimental/property-inspector-table/external "react"" line-rate="1" branch-rate="1">

(PS - Great project!)

[bcoe]

@DLehenbauer thank you for the bug report. We may need to fix this upstream in the reporting module:

https://github.com/istanbuljs/istanbuljs/tree/master/packages/istanbul-reports/lib/cobertura

We fixed a similar bug in the past, does anything jump out at you, as to where I've missed escaping?

[DLehenbauer]

Thank you for taking a look. I thought it might be an easy one to spot from code inspection, sorry.

Here's a reduced repro:

git clone https://github.com/DLehenbauer/c8-repro.git
cd c8-repro
npm i
npm run build
npm run test:coverage
head nyc/report/cobertura-coverage.xml

Line 10 of the XML is malformed as shown above.

The problem seems to be related to using webpack externals to omit 'react' from the bundle.

If you remove the line indicated below from the bottom of webpack.prod.js and re-run coverage the resulting XML is valid.

    externals: [{
      'react': 'react',                 <<-- Delete me
      ...
    }],

(Let me know if you have any trouble w/the repo. I can reduce more if it helps.)

[DLehenbauer]

Hi @Bcoe - Does this just need escape(..) around the filename when emitting the <class> tag on line 85? https://github.com/istanbuljs/istanbuljs/tree/master/packages/istanbul-reports/lib/cobertura

[bcoe]

Does this just need escape(..) around the filename when emitting the

@DLehenbauer I believe you're right that it's probably just a missing escape in that upstream repository, bother you to submit a patch and I should be able to approve?