From 7e9cf654897904301462483e19a274033a9f9eeb Mon Sep 17 00:00:00 2001
From: nnposter <nnposter@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Sun, 21 Jul 2019 00:44:32 +0000
Subject: [PATCH] Prevent backslash-escaping of CR characters in XML output.
 Fixes #1648

---
 CHANGELOG |  3 +++
 output.cc | 17 +++++++++++++++--
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 6dcf21f90..8321a67f5 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,8 @@
 #Nmap Changelog ($Id$); -*-text-*-
 
+o [NSE][GH#1648] CR characters are no longer treated as illegal in script XML
+  output. [nnposter]
+
 o [GH#1659] Allow resuming nmap scan with lengthy command line
   [Clément Notin]
 
diff --git a/output.cc b/output.cc
index 5c270dfb0..612d96a5a 100644
--- a/output.cc
+++ b/output.cc
@@ -493,8 +493,21 @@ static std::string escape_for_screen(const std::string s) {
    xml_write_escaped is not enough; some characters are not allowed to appear in
    XML, not even escaped. */
 std::string protect_xml(const std::string s) {
-  /* escape_for_screen is good enough. */
-  return escape_for_screen(s);
+  std::string r;
+
+  for (unsigned int i = 0; i < s.size(); i++) {
+    char buf[5];
+    unsigned char c = s[i];
+    // Printable and some whitespace ok.
+    if (c == '\t' || c == '\r' || c == '\n' || (0x20 <= c && c <= 0x7e)) {
+      r += c;
+    } else {
+      Snprintf(buf, sizeof(buf), "\\x%02X", c);
+      r += buf;
+    }
+  }
+
+  return r;
 }
 
 /* This is a helper function to determine the ordering of the script results