fix: escape environment context XML

codex-rs/core/src/environment_context.rs

@@ -125,41 +125,64 @@ impl EnvironmentContext {
     pub fn serialize_to_xml(self) -> String {
         let mut lines = vec![ENVIRONMENT_CONTEXT_OPEN_TAG.to_string()];
         if let Some(cwd) = self.cwd {
-            lines.push(format!("  <cwd>{}</cwd>", cwd.to_string_lossy()));
+            lines.push(format!(
+                "  <cwd>{}</cwd>",
+                xml_escape(cwd.to_string_lossy())
+            ));
         }
         if let Some(approval_policy) = self.approval_policy {
             lines.push(format!(
-                "  <approval_policy>{approval_policy}</approval_policy>"
+                "  <approval_policy>{}</approval_policy>",
+                xml_escape(approval_policy.to_string())
             ));
         }
         if let Some(sandbox_mode) = self.sandbox_mode {
-            lines.push(format!("  <sandbox_mode>{sandbox_mode}</sandbox_mode>"));
+            lines.push(format!(
+                "  <sandbox_mode>{}</sandbox_mode>",
+                xml_escape(sandbox_mode.to_string())
+            ));
         }
         if let Some(network_access) = self.network_access {
             lines.push(format!(
-                "  <network_access>{network_access}</network_access>"
+                "  <network_access>{}</network_access>",
+                xml_escape(network_access.to_string())
             ));
         }
         if let Some(writable_roots) = self.writable_roots {
             lines.push("  <writable_roots>".to_string());
             for writable_root in writable_roots {
                 lines.push(format!(
                     "    <root>{}</root>",
-                    writable_root.to_string_lossy()
+                    xml_escape(writable_root.to_string_lossy())
                 ));
             }
             lines.push("  </writable_roots>".to_string());
         }
         if let Some(shell) = self.shell
             && let Some(shell_name) = shell.name()
         {
-            lines.push(format!("  <shell>{shell_name}</shell>"));
+            lines.push(format!("  <shell>{}</shell>", xml_escape(shell_name)));
         }
         lines.push(ENVIRONMENT_CONTEXT_CLOSE_TAG.to_string());
         lines.join("\n")
     }
 }
 
+fn xml_escape<S: AsRef<str>>(input: S) -> String {
+    let mut escaped = String::with_capacity(input.as_ref().len());
+    for ch in input.as_ref().chars() {
+        match ch {
+            '&' => escaped.push_str("&amp;"),
+            '<' => escaped.push_str("&lt;"),
+            '>' => escaped.push_str("&gt;"),
+            '\'' => escaped.push_str("&apos;"),
+            '"' => escaped.push_str("&quot;"),
+            other => escaped.push(other),
+        }
+    }
+    escaped
+}
+
 impl From<EnvironmentContext> for ResponseItem {
     fn from(ec: EnvironmentContext) -> Self {
         ResponseItem::Message {
@@ -212,6 +235,30 @@ mod tests {
         assert_eq!(context.serialize_to_xml(), expected);
     }
 
+    #[test]
+    fn serialize_to_xml_escapes_ampersand() {
+        let context = EnvironmentContext::new(
+            Some(PathBuf::from("/tmp/Research & Development")),
+            None,
+            None,
+            None,
+        );
+
+        let serialized = context.serialize_to_xml();
+        assert!(serialized.contains("<cwd>"));
+        assert!(serialized.contains("</cwd>"));
+        // Proper XML should escape `&` as `&amp;`.
+        assert!(serialized.contains("Research &amp; Development"));
+        assert!(!serialized.contains("Research & Development"));
+    }
+
+    #[test]
+    fn xml_escape_replaces_reserved_characters() {
+        let escaped = super::xml_escape("<&>'\"");
+
+        assert_eq!(escaped, "&lt;&amp;&gt;&apos;&quot;");
+    }
+
     #[test]
     fn serialize_read_only_environment_context() {
         let context = EnvironmentContext::new(