From db011157fb19c65ba42f4a9d58640a3114b86cf0 Mon Sep 17 00:00:00 2001
From: Saurabh <saurabh.tripathi@epicalgroup.com>
Date: Wed, 30 Oct 2024 12:25:36 +0100
Subject: [PATCH] Fix XML character escaping in 'spo listitem batch set'
 command. Closes #6430

---
 src/m365/spo/commands/listitem/listitem-batch-set.spec.ts | 5 +++--
 src/m365/spo/commands/listitem/listitem-batch-set.ts      | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts b/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts
index 0497d2795ec..103a638838a 100644
--- a/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts
+++ b/src/m365/spo/commands/listitem/listitem-batch-set.spec.ts
@@ -101,9 +101,9 @@ describe(commands.LISTITEM_BATCH_SET, () => {
     assert.notStrictEqual(command.description, null);
   });
 
-  it('updates single item in batch to a sharepoint list retrieved by listUrl including empty values', async () => {
+  it('updates single item in batch to a sharepoint list retrieved by listUrl including empty values and special characters', async () => {
     const csvContentHeadersEmptyValues = `Id,ContentType,Title,SingleChoiceField`;
-    const csvContentLineEmptyValues = `10,Item,Title A,`;
+    const csvContentLineEmptyValues = `10,Item,Title A <>&",`;
     const csvContentEmptyValues = `${csvContentHeadersEmptyValues}\n${csvContentLineEmptyValues}`;
     const listServerRelativeUrl: string = urlUtil.getServerRelativePath(webUrl, listUrl);
     const filterFields = ["InternalName eq 'ContentType'", "InternalName eq 'Title'", "InternalName eq 'SingleChoiceField'"];
@@ -136,6 +136,7 @@ describe(commands.LISTITEM_BATCH_SET, () => {
 
     await command.action(logger, { options: { webUrl: webUrl, filePath: filePath, listUrl: listUrl, idColumn: idColumn, systemUpdate: true, verbose: true } } as any);
     assert(postStub.called);
+    assert(postStub.args[0][0].data.includes('Title A &lt;&gt;&amp;&quot;'));
   });
 
   it('system updates single item in batch to a sharepoint list retrieved by id without user fields', async () => {
diff --git a/src/m365/spo/commands/listitem/listitem-batch-set.ts b/src/m365/spo/commands/listitem/listitem-batch-set.ts
index 9741baacdff..8d3415c5a7f 100644
--- a/src/m365/spo/commands/listitem/listitem-batch-set.ts
+++ b/src/m365/spo/commands/listitem/listitem-batch-set.ts
@@ -219,7 +219,7 @@ class SpoListItemBatchSetCommand extends SpoCommand {
             actionString += `<Method Name="SetFieldValue" Id="${index += 1}" ObjectPathId="${objectPathId}"><Parameters><Parameter Type="String">${field.InternalName}</Parameter><Parameter Type="Array">${lookupMultiString.join('')}</Parameter></Parameters></Method>`;
             break;
           default:
-            actionString += `<Method Name="ParseAndSetFieldValue" Id="${index += 1}" ObjectPathId="${objectPathId}"><Parameters><Parameter Type="String">${field.InternalName}</Parameter><Parameter Type="String">${(<any>row)[field.InternalName].toString()}</Parameter></Parameters></Method>`;
+            actionString += `<Method Name="ParseAndSetFieldValue" Id="${index += 1}" ObjectPathId="${objectPathId}"><Parameters><Parameter Type="String">${field.InternalName}</Parameter><Parameter Type="String">${formatting.escapeXml((<any>row)[field.InternalName].toString())}</Parameter></Parameters></Method>`;
             break;
         }
       }