diff --git a/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts b/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts index 0497d2795e..103a638838 100644 --- a/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts +++ b/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts @@ -101,9 +101,9 @@ describe(commands.LISTITEM_BATCH_SET, () => { assert.notStrictEqual(command.description, null); }); - it('updates single item in batch to a sharepoint list retrieved by listUrl including empty values', async () => { + it('updates single item in batch to a sharepoint list retrieved by listUrl including empty values and special characters', async () => { const csvContentHeadersEmptyValues = `Id,ContentType,Title,SingleChoiceField`; - const csvContentLineEmptyValues = `10,Item,Title A,`; + const csvContentLineEmptyValues = `10,Item,Title A <>&",`; const csvContentEmptyValues = `${csvContentHeadersEmptyValues}\n${csvContentLineEmptyValues}`; const listServerRelativeUrl: string = urlUtil.getServerRelativePath(webUrl, listUrl); const filterFields = ["InternalName eq 'ContentType'", "InternalName eq 'Title'", "InternalName eq 'SingleChoiceField'"]; @@ -136,6 +136,7 @@ describe(commands.LISTITEM_BATCH_SET, () => { await command.action(logger, { options: { webUrl: webUrl, filePath: filePath, listUrl: listUrl, idColumn: idColumn, systemUpdate: true, verbose: true } } as any); assert(postStub.called); + assert(postStub.args[0][0].data.includes('Title A <>&"')); }); it('system updates single item in batch to a sharepoint list retrieved by id without user fields', async () => { diff --git a/src/m365/spo/commands/listitem/listitem-batch-set.ts b/src/m365/spo/commands/listitem/listitem-batch-set.ts index 9741baacdf..8d3415c5a7 100644 --- a/src/m365/spo/commands/listitem/listitem-batch-set.ts +++ b/src/m365/spo/commands/listitem/listitem-batch-set.ts @@ -219,7 +219,7 @@ class SpoListItemBatchSetCommand extends SpoCommand { actionString += `${field.InternalName}${lookupMultiString.join('')}`; break; default: - actionString += `${field.InternalName}${(row)[field.InternalName].toString()}`; + actionString += `${field.InternalName}${formatting.escapeXml((row)[field.InternalName].toString())}`; break; } }