From 58ff8c55635fc02b06c5d765cbed2ab07f9db1a3 Mon Sep 17 00:00:00 2001
From: Hivert Quentin <quentin.hivert.fr@gmail.com>
Date: Wed, 11 Nov 2026 19:52:00 +0100
Subject: [PATCH] #3128: do not put forbidden char in xml

---
 SoObjects/SOGo/NSString+Utilities.m | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/SoObjects/SOGo/NSString+Utilities.m b/SoObjects/SOGo/NSString+Utilities.m
index 5cbc74d97..0c8f38c14 100644
--- a/SoObjects/SOGo/NSString+Utilities.m
+++ b/SoObjects/SOGo/NSString+Utilities.m
@@ -437,6 +437,10 @@ static int cssEscapingCount;
               break;
             }
         default:
+          /* U+FFFE and U+FFFF are not allowed in XML, not even as a
+             character reference: drop them */
+          if (chars[i] == 0xFFFE || chars[i] == 0xFFFF)
+            break;
           /* escape big chars */
           if (chars[i] > 127)
             {