Apply input validation to match dataform constraints

[guusdk]

Using the admin panel, a user can input pretty much any value to the service discovery information. There likely needs to be some input validation done (can form name values include whitespace characters?)

[Fishbowler]

Also, an approach to XML escaping. Right now it's "escape all the things". Using a string of <>?:"{}|_+ for the variable name, label and value gives this:

<field var="&lt;&gt;?:&quot;{}|_+" label="&lt;&gt;?:&quot;{}|_+">
    <value>&lt;&gt;?:"{}|_+</value>
</field>

Should the same escaping occur for quoted strings in XML attributes as it does for the raw <value>?

Is there a valid use case for any of the XML-escapable characters in any of these fields?

[guusdk]

I'm not immediately seeing a better approach that adds value, but doesn't compromise security. Suggestions?