Reply to thread

Message

<blockquote data-quote="RoChess" data-source="post: 648402" data-attributes="member: 18896">The problem is at TheTVdB, they put the reserved byte value in there \0x0B, which freaks out the XML parser that MP-TVSeries uses.I analyzed the de.XML file and it is for:To be exact the &quot;freiem&lt;bh:0b&gt;Fu&quot; and &quot;Das bringt&lt;bh:0b&gt;Dr. Judith&quot; sections.\0x0b represents vertical TAB, which is the weirdest thing I've seen at TheTVdB, so no wonder C# XML Parser freaks out over it.The problem is that the XML v1.0 specifications do not allow for vertical tabs to be used.I believe v1.1 does, but TheTVdB clearly identifies itself as: &quot;&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; ?&gt;&quot;I'm sure damienh can code in a workaround (and I'm asking already), but where does it end. The TheTVdB admins need to adhere to the correct standards and fix their code. So eventhough a workaround might get added, it will be much faster if you notify the TheTVdB admins to scan their database for vertical tab chars and replace them with the usual [LF][CR] sequence. They should also filter it then on input level, because if this is possible, it usually means an SQL injection is possible as well with the right sequence.</blockquote>

[QUOTE="RoChess, post: 648402, member: 18896"] The problem is at TheTVdB, they put the reserved byte value in there \0x0B, which freaks out the XML parser that MP-TVSeries uses. I analyzed the de.XML file and it is for: To be exact the "freiem<bh:0b>Fu" and "Das bringt<bh:0b>Dr. Judith" sections. \0x0b represents vertical TAB, which is the weirdest thing I've seen at TheTVdB, so no wonder C# XML Parser freaks out over it. The problem is that the XML v1.0 specifications do not allow for vertical tabs to be used. I believe v1.1 does, but TheTVdB clearly identifies itself as: "<?xml version="1.0" encoding="UTF-8" ?>" I'm sure damienh can code in a workaround (and I'm asking already), but where does it end. The TheTVdB admins need to adhere to the correct standards and fix their code. So eventhough a workaround might get added, it will be much faster if you notify the TheTVdB admins to scan their database for vertical tab chars and replace them with the usual [LF][CR] sequence. They should also filter it then on input level, because if this is possible, it usually means an SQL injection is possible as well with the right sequence. [/QUOTE]

Verification