BOINC originally used a line-oriented parser with primitives like
parse_str(tag, buf, len);
This is not a general XML parser; it's able to parse only the XML generated by BOINC itself. For example, it can parse
<file> <url>http://foo.bar</url> </fil>
<file> <url> http://foo.bar </url> </file>
More recently, we added a better parser (class XML_PARSER). However, much of the code still uses the old parser.
Both of the parsers decode XML entities when parsing strings.
The functions that generate XML don't generally encode XML entities in strings. Most strings are generated by BOINC itself and will never contain special characters. The following fields may contain special characters, and are XML-encoded by the functions that generate XML:
client: PROJECT::user_name, team_name FILE_INFO::url APP_INIT_DATA::user_name, team_name PROXY_INFO::http_user_name, http_user_passwd, socks5_user_name, socks5_passwd HOST_INFO::p_vendor, p_model, p_features, os_name, os_version, serialnum server (db_dump and db_purge): USER::name, url TEAM::name, url, name_hteml, description RESULT::stderr_out
In addition, the RESULT::stderr_out (client) is enclosed in <![CDATA[ ...]]>