From 5163861588b229fe2e13e61bf65fbf5b88743bb3 Mon Sep 17 00:00:00 2001
From: bifs <127015052+bifs@users.noreply.github.com>
Date: Tue, 5 Mar 2024 04:08:12 +0900
Subject: [PATCH] fix(bundler): escape potentially problematic strings in an
 XML (#9040)

* fix(bundler): escape potentially problematic strings in an XML (#9030)

- replace characters invalid in XML with their escaped form to properly bundle resources with such characters in their pathnames.

* change file
---
 .changes/escape-paths-wix.md                  | 5 +++++
 tooling/bundler/src/bundle/windows/msi/wix.rs | 6 +++---
 2 files changed, 8 insertions(+), 3 deletions(-)
 create mode 100644 .changes/escape-paths-wix.md

diff --git a/.changes/escape-paths-wix.md b/.changes/escape-paths-wix.md
new file mode 100644
index 000000000..80d98dfd4
--- /dev/null
+++ b/.changes/escape-paths-wix.md
@@ -0,0 +1,5 @@
+---
+"tauri-bundler": patch:bug
+---
+
+On Windows, fix building WiX installer when resources contains an XML charcter that should be escaped.
\ No newline at end of file
diff --git a/tooling/bundler/src/bundle/windows/msi/wix.rs b/tooling/bundler/src/bundle/windows/msi/wix.rs
index c0f8c61c3..78e940377 100644
--- a/tooling/bundler/src/bundle/windows/msi/wix.rs
+++ b/tooling/bundler/src/bundle/windows/msi/wix.rs
@@ -16,7 +16,7 @@ use crate::bundle::{
   },
 };
 use anyhow::{bail, Context};
-use handlebars::{to_json, Handlebars};
+use handlebars::{html_escape, to_json, Handlebars};
 use log::info;
 use regex::Regex;
 use serde::{Deserialize, Serialize};
@@ -122,7 +122,7 @@ impl ResourceDirectory {
           r#"<Component Id="{id}" Guid="{guid}" Win64="$(var.Win64)" KeyPath="yes"><File Id="PathFile_{id}" Source="{path}" /></Component>"#,
           id = file.id,
           guid = file.guid,
-          path = file.path.display()
+          path = html_escape(&file.path.display().to_string())
         ).as_str()
       );
     }
@@ -140,7 +140,7 @@ impl ResourceDirectory {
       format!(
         r#"<Directory Id="I{id}" Name="{name}">{files}{directories}</Directory>"#,
         id = Uuid::new_v4().as_simple(),
-        name = self.name,
+        name = html_escape(&self.name),
         files = files,
         directories = directories,
       )