escape characters for xml reporters

Source/SwiftLintFramework/Reporters/CheckstyleReporter.swift

@@ -25,11 +25,11 @@ public struct CheckstyleReporter: Reporter {
     }
 
     private static func generateForSingleViolation(_ violation: StyleViolation) -> String {
-        let file: String = violation.location.file ?? "<nopath>"
+        let file: String = violation.location.file?.escapedForXml() ?? "<nopath>"
         let line: Int = violation.location.line ?? 0
         let col: Int = violation.location.character ?? 0
         let severity: String = violation.severity.rawValue
-        let reason: String = violation.reason
+        let reason: String = violation.reason.escapedForXml()
         return [
             "\n\t<file name=\"", file, "\">\n",
             "\t\t<error line=\"\(line)\" ",

Source/SwiftLintFramework/Reporters/HTMLReporter.swift

@@ -120,7 +120,7 @@ public struct HTMLReporter: Reporter {
     private static func generateSingleRow(for violation: StyleViolation, at index: Int) -> String {
         let severity: String = violation.severity.rawValue.capitalized
         let location = violation.location
-        let file: String = location.file ?? ""
+        let file: String = location.file?.escapedForXml() ?? ""
         let line: Int = location.line ?? 0
         let character: Int = location.character ?? 0
         return [
@@ -129,7 +129,7 @@ public struct HTMLReporter: Reporter {
             "\t\t\t\t\t<td>", file, "</td>\n",
             "\t\t\t\t\t<td align=\"center\">\(line):\(character)</td>\n",
             "\t\t\t\t\t<td class=\'", severity.lowercased(), "\'>", severity, "</td>\n",
-            "\t\t\t\t\t<td>\(violation.reason)</td>\n",
+            "\t\t\t\t\t<td>\(violation.reason.escapedForXml())</td>\n",
             "\t\t\t\t</tr>\n"
         ].joined()
     }

Source/SwiftLintFramework/Reporters/JUnitReporter.swift

@@ -19,11 +19,12 @@ public struct JUnitReporter: Reporter {
     public static func generateReport(_ violations: [StyleViolation]) -> String {
         return "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<testsuites><testsuite>" +
             violations.map({ violation in
-                let fileName = violation.location.file ?? "<nopath>"
+                let fileName = violation.location.file?.escapedForXml() ?? "<nopath>"
                 let severity = violation.severity.rawValue + ":\n"
                 let message = severity + "Line:" + String(violation.location.line ?? 0) + " "
+                let reason = violation.reason.escapedForXml()
                 return ["\n\t<testcase classname='Formatting Test' name='\(fileName)\'>\n",
-                    "<failure message='\(violation.reason)\'>" + message + "</failure>",
+                    "<failure message='\(reason)\'>" + message + "</failure>",
                     "\t</testcase>"].joined(separator: "")
             }).joined(separator: "") + "\n</testsuite></testsuites>"
     }

Source/SwiftLintFramework/Reporters/String+XML.swift

@@ -0,0 +1,25 @@
+//
+//  CheckstyleReporter.swift
+//  SwiftLint
+//
+//  Created by Fabian Ehrentraud on 12/12/16.
+//  Copyright © 2016 Realm. All rights reserved.
+//
+
+extension String {
+    func escapedForXml() -> String {
+        // & needs to go first, otherwise other replacements will be replaced again
+        let htmlEscapes = [
+            ("&", "&"),
+            ("\"", """),
+            ("'", "'"),
+            (">", ">"),
+            ("<", "&lt;")
+        ]
+        var newString = self
+        for (key, value) in htmlEscapes {
+            newString = newString.replacingOccurrences(of: key, with: value)
+        }
+        return newString
+    }
+}