CNA-BUG-159: ToastPushNotificationMessage::SendAsync inserts Title and SubTitle into the toast XML without escaping

CNA snapshot 009d40f5  ·  Known Issues › Current bugs  ·  source links pinned to 009d40f5

The toast body is built by string concatenation, so a Title or SubTitle containing an ampersand, a less-than sign or markup produces malformed or altered XML; the channel delivers the bytes unparsed.

Identifier

CNA-BUG-159

Category

Bug

Subsystem

Networking & gamer services

Status

Open

Verified against

CNA 009d40f5 (009d40f5dd085c4e674d3479675fac84b12b3e0a)

Severity

Low (a triage suggestion, not a project priority)

Evidence basis

Source-verified: read at TARGET, not executed

Tests touching this area

Yes: see Current tests

Affected contract

Microsoft::Phone::Notification::ToastPushNotificationMessage::Title, SubTitle and SendAsync(const System::Uri&)

Expected behaviour

The header describes the wire form as the one Windows Phone's push service defined, and the body is sent as text/xml inside a <wp:Notification> document. Title and subtitle should be encoded as XML character data, so that any text a game passes yields a well-formed document.

Actual behaviour at TARGET

ToastPushNotificationMessage::SendAsync concatenates the XML declaration, <wp:Notification xmlns:wp="WPNotification"><wp:Toast><wp:Text1>, Title, </wp:Text1><wp:Text2>, SubTitle and the closing tags. A title such as Fish & Chips yields ill-formed XML, and text containing markup changes the document's structure. The receiving HttpNotificationChannel does not parse XML, so the application's handler gets the bytes and fails, or misreads them, when it parses the toast.

Source locations

• modules/phone/src/PushNotificationSender.cpp — ToastPushNotificationMessage::SendAsync body construction

Evidence

Checked by reading PushNotificationSender.cpp at 009d40f5 (unchanged since the earlier recorded pin). Not executed.

Focused reproduction

Illustrative (not compiled for this entry):

Microsoft::Phone::Notification::ToastPushNotificationMessage toast;
toast.Title = "Fish & Chips";
toast.SubTitle = "Today only";
toast.SendAsync(*channel.getChannelUriProperty());
// the handler receives ...<wp:Text1>Fish & Chips</wp:Text1>... which no XML parser accepts

Current tests

PushNotificationSenderTest.AToastCarriesItsTitleToTheReceiver sends a plain ASCII title and checks that the received body contains it.

Regression test

Send a toast whose title and subtitle contain &, < and >; the received body must contain the escaped forms (&, <, >) and parse as XML.

Blast radius

Ports that send toasts built from player, localised or downloaded text. Raw notifications are unaffected.

Workaround

Escape &, <, > and quotes in Title and SubTitle before calling SendAsync.