Escape \r in text and \r/\n/\t in attributes during serde serialization

The serde serializer wrote literal \r into text content and \r, \n, \t
into attribute values. These characters are silently modified by XML
end-of-line normalization and attribute-value normalization respectively,
causing data loss on round-trip.

Now escape_list() escapes \r as &tafia#13; in text content at all
QuoteLevels, and escapes \r/\n/\t as &tafia#13;/&tafia#10;/&tafia#9; in attribute
values. This is consistent with the behavior of libxml2 / lxml.

Make note of the fact that CDATA sections are inherently lossy for \r
since character references are not permitted inside CDATA.

closes tafia#670
closes tafia#990

Assisted-By: Claude Opus 4.6

Author: dralley

Changelog.md

@@ -61,6 +61,9 @@ The MSRV has been raised to 1.86.
 
 ### Bug Fixes
 
+- [#670]: Serde serializer now escapes `\r`, `\n`, and `\t` in attribute values
+  as `
`, `
`, and `	` respectively, preventing silent data loss from
+  XML attribute-value normalization on round-trip.
 - [#989]: `Attributes::new` and `Attributes::html` now return empty iterators when
   their starting position is past the end of the input instead of panicking.
 - [#977]: `NamespaceResolver::push` (and hence every `NsReader` `Start`/`Empty`
@@ -76,6 +79,8 @@ The MSRV has been raised to 1.86.
   limit (default 128, matching `serde_json`). Deeply nested XML returns
   `DeError::TooDeeplyNested` instead of overflowing the native call stack.
   Use `Deserializer::recursion_limit()` to adjust.
+- [#990]: Serde serializer now escapes `\r` in text content as `
`, preventing
+  silent conversion to `\n` from XML end-of-line normalization on round-trip.
 
 ### Misc Changes
 
@@ -87,12 +92,14 @@ The MSRV has been raised to 1.86.
   `decode_and_unescape_value_with()`. Use `normalized_value()` and
   `normalized_value_with()` instead.
 
+[#670]: https://github.com/tafia/quick-xml/issues/670
 [#963]: https://github.com/tafia/quick-xml/pull/963
 [#977]: https://github.com/tafia/quick-xml/issues/977
 [#980]: https://github.com/tafia/quick-xml/issues/980
 [#978]: https://github.com/tafia/quick-xml/issues/978
 [#983]: https://github.com/tafia/quick-xml/issues/983
 [#989]: https://github.com/tafia/quick-xml/issues/989
+[#990]: https://github.com/tafia/quick-xml/issues/990
 
 ## 0.41.0 -- 2026-06-29
 

src/se/element.rs

@@ -743,7 +743,7 @@ mod tests {
         serialize_as!(seq_empty: Vec::<usize>::new() => "");
         serialize_as!(tuple: ("<\"&'>", "with\t\n\r spaces", 3usize)
             => "<root>&lt;&quot;&amp;&apos;&gt;</root>\
-                <root>with\t\n\r spaces</root>\
+                <root>with\t\n&#13; spaces</root>\
                 <root>3</root>");
         serialize_as!(tuple_struct: Tuple("first", 42)
             => "<root>first</root>\
@@ -1457,7 +1457,7 @@ mod tests {
         serialize_as!(seq_empty: Vec::<usize>::new() => "");
         serialize_as!(tuple: ("<\"&'>", "with\t\n\r spaces", 3usize)
             => "<root>&lt;&quot;&amp;&apos;&gt;</root>\n\
-                <root>with\t\n\r spaces</root>\n\
+                <root>with\t\n&#13; spaces</root>\n\
                 <root>3</root>");
         serialize_as!(tuple_struct: Tuple("first", 42)
             => "<root>first</root>\n\

src/se/mod.rs

@@ -322,7 +322,7 @@ where
 pub enum TextFormat {
     /// Serialize as regular text content with escaping
     Text,
-    /// Serialize as CDATA section without escaping
+    /// Serialize as CDATA section without escaping.
     CData,
 }
 

src/se/simple_type.rs

@@ -130,6 +130,12 @@ where
 }
 
 /// Escapes XSD simple type value
+///
+/// XML EOL normalization (Section 2.11) converts \r to \n before parsing, and
+/// attribute-value normalization (Section 3.3.3) converts \r, \n, \t to space.
+/// We escape these as character references (e.g. 
) which bypass normalization,
+/// preserving the original characters on round-trip as seen in other implementations
+/// such as libxml2.
 fn escape_list<W>(mut writer: W, value: &str, target: QuoteTarget, level: QuoteLevel) -> fmt::Result
 where
     W: Write,
@@ -146,31 +152,49 @@ where
             }
             Ok(())
         }
-        (_, Full) => escape_into(writer, value, |ch| match ch {
+        (Text, Full) => escape_into(writer, value, |ch| match ch {
+            // XML EOL normalization (Section 2.11) would convert \r to \n
+            b'\r' => true,
             // Required characters to escape
             b'&' | b'<' | b'>' | b'\'' | b'\"' => true,
             _ => false,
         }),
-        //----------------------------------------------------------------------
         (Text, Partial) => escape_into(writer, value, |ch| match ch {
+            // XML EOL normalization (Section 2.11) would convert \r to \n
+            b'\r' => true,
             // Required characters to escape
             b'&' | b'<' | b'>' => true,
             _ => false,
         }),
         (Text, Minimal) => escape_into(writer, value, |ch| match ch {
+            // XML EOL normalization (Section 2.11) would convert \r to \n
+            b'\r' => true,
             // Required characters to escape
             b'&' | b'<' => true,
             _ => false,
         }),
         //----------------------------------------------------------------------
+        (_, Full) => escape_into(writer, value, |ch| match ch {
+            // XML EOL normalization (Section 2.11) and attribute-value normalization
+            // (Section 3.3.3) would convert these to \n and space respectively
+            b'\r' | b'\n' | b'\t' => true,
+            // Required characters to escape
+            b'&' | b'<' | b'>' | b'\'' | b'\"' => true,
+            _ => false,
+        }),
+        //----------------------------------------------------------------------
         (DoubleQAttr, Partial) => escape_into(writer, value, |ch| match ch {
+            // XML EOL / attribute-value normalization (Section 2.11, Section 3.3.3)
+            b'\r' | b'\n' | b'\t' => true,
             // Required characters to escape
             b'&' | b'<' | b'>' => true,
             // Double quoted attribute should escape quote
             b'"' => true,
             _ => false,
         }),
         (DoubleQAttr, Minimal) => escape_into(writer, value, |ch| match ch {
+            // XML EOL / attribute-value normalization (Section 2.11, Section 3.3.3)
+            b'\r' | b'\n' | b'\t' => true,
             // Required characters to escape
             b'&' | b'<' => true,
             // Double quoted attribute should escape quote
@@ -179,13 +203,17 @@ where
         }),
         //----------------------------------------------------------------------
         (SingleQAttr, Partial) => escape_into(writer, value, |ch| match ch {
+            // XML EOL / attribute-value normalization (Section 2.11, Section 3.3.3)
+            b'\r' | b'\n' | b'\t' => true,
             // Required characters to escape
             b'&' | b'<' | b'>' => true,
             // Single quoted attribute should escape quote
             b'\'' => true,
             _ => false,
         }),
         (SingleQAttr, Minimal) => escape_into(writer, value, |ch| match ch {
+            // XML EOL / attribute-value normalization (Section 2.11, Section 3.3.3)
+            b'\r' | b'\n' | b'\t' => true,
             // Required characters to escape
             b'&' | b'<' => true,
             // Single quoted attribute should escape quote
@@ -893,7 +921,7 @@ mod tests {
             fn text() {
                 assert_eq!(
                     escape_list("text<\"'&> \t\n\rtext", QuoteTarget::Text, QuoteLevel::Full),
-                    "text&lt;&quot;&apos;&amp;&gt; \t\n\rtext"
+                    "text&lt;&quot;&apos;&amp;&gt; \t\n&#13;text"
                 );
             }
 
@@ -905,7 +933,7 @@ mod tests {
                         QuoteTarget::DoubleQAttr,
                         QuoteLevel::Full
                     ),
-                    "text&lt;&quot;&apos;&amp;&gt; \t\n\rtext"
+                    "text&lt;&quot;&apos;&amp;&gt; &#9;&#10;&#13;text"
                 );
             }
 
@@ -917,7 +945,7 @@ mod tests {
                         QuoteTarget::SingleQAttr,
                         QuoteLevel::Full
                     ),
-                    "text&lt;&quot;&apos;&amp;&gt; \t\n\rtext"
+                    "text&lt;&quot;&apos;&amp;&gt; &#9;&#10;&#13;text"
                 );
             }
         }
@@ -934,7 +962,7 @@ mod tests {
                         QuoteTarget::Text,
                         QuoteLevel::Partial
                     ),
-                    "text&lt;\"'&amp;&gt; \t\n\rtext"
+                    "text&lt;\"'&amp;&gt; \t\n&#13;text"
                 );
             }
 
@@ -946,7 +974,7 @@ mod tests {
                         QuoteTarget::DoubleQAttr,
                         QuoteLevel::Partial
                     ),
-                    "text&lt;&quot;'&amp;&gt; \t\n\rtext"
+                    "text&lt;&quot;'&amp;&gt; &#9;&#10;&#13;text"
                 );
             }
 
@@ -958,7 +986,7 @@ mod tests {
                         QuoteTarget::SingleQAttr,
                         QuoteLevel::Partial
                     ),
-                    "text&lt;\"&apos;&amp;&gt; \t\n\rtext"
+                    "text&lt;\"&apos;&amp;&gt; &#9;&#10;&#13;text"
                 );
             }
         }
@@ -975,7 +1003,7 @@ mod tests {
                         QuoteTarget::Text,
                         QuoteLevel::Minimal
                     ),
-                    "text&lt;\"'&amp;> \t\n\rtext"
+                    "text&lt;\"'&amp;> \t\n&#13;text"
                 );
             }
 
@@ -987,7 +1015,7 @@ mod tests {
                         QuoteTarget::DoubleQAttr,
                         QuoteLevel::Minimal
                     ),
-                    "text&lt;&quot;'&amp;> \t\n\rtext"
+                    "text&lt;&quot;'&amp;> &#9;&#10;&#13;text"
                 );
             }
 
@@ -999,7 +1027,7 @@ mod tests {
                         QuoteTarget::SingleQAttr,
                         QuoteLevel::Minimal
                     ),
-                    "text&lt;\"&apos;&amp;> \t\n\rtext"
+                    "text&lt;\"&apos;&amp;> &#9;&#10;&#13;text"
                 );
             }
         }

tests/serde-issues.rs

@@ -539,6 +539,65 @@ fn issue655() {
     );
 }
 
+/// Regression tests for https://github.com/tafia/quick-xml/issues/670.
+///
+/// The serde serializer must escape `\r`, `\n`, and `\t` in attribute values so
+/// they survive XML attribute-value normalization (Section 3.3.3) on round-trip.
+mod issue670 {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    #[derive(Debug, Deserialize, Serialize, PartialEq)]
+    struct Root {
+        #[serde(rename = "@value")]
+        value: String,
+    }
+
+    #[test]
+    fn cr_lf_in_attribute() {
+        let value = Root {
+            value: "new\r\nline".into(),
+        };
+        let xml = to_string(&value).unwrap();
+        assert_eq!(xml, r#"<Root value="new&#13;&#10;line"/>"#);
+        let roundtripped: Root = from_str(&xml).unwrap();
+        assert_eq!(roundtripped, value);
+    }
+
+    #[test]
+    fn cr_in_attribute() {
+        let value = Root {
+            value: "new\rline".into(),
+        };
+        let xml = to_string(&value).unwrap();
+        assert_eq!(xml, r#"<Root value="new&#13;line"/>"#);
+        let roundtripped: Root = from_str(&xml).unwrap();
+        assert_eq!(roundtripped, value);
+    }
+
+    #[test]
+    fn lf_in_attribute() {
+        let value = Root {
+            value: "new\nline".into(),
+        };
+        let xml = to_string(&value).unwrap();
+        assert_eq!(xml, r#"<Root value="new&#10;line"/>"#);
+        let roundtripped: Root = from_str(&xml).unwrap();
+        assert_eq!(roundtripped, value);
+    }
+
+    #[test]
+    fn tab_in_attribute() {
+        let value = Root {
+            value: "col1\tcol2".into(),
+        };
+        let xml = to_string(&value).unwrap();
+        assert_eq!(xml, r#"<Root value="col1&#9;col2"/>"#);
+        let roundtripped: Root = from_str(&xml).unwrap();
+        assert_eq!(roundtripped, value);
+    }
+}
+
 /// Regression test for https://github.com/tafia/quick-xml/issues/674
 #[test]
 fn issue674() {
@@ -1238,3 +1297,99 @@ mod issue978 {
         assert_eq!(result.unwrap().item.len(), 200);
     }
 }
+
+/// Regression tests for https://github.com/tafia/quick-xml/issues/990.
+///
+/// The serde serializer must escape `\r` in text content so it survives
+/// XML end-of-line normalization (Section 2.11) on round-trip.
+///
+/// This behavior is not stated directly in the spec, but it is exhibited
+/// by implementations such as libxml2.
+mod issue990 {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    #[derive(Debug, Deserialize, Serialize, PartialEq)]
+    #[serde(rename = "value")]
+    struct Value {
+        #[serde(rename = "$value")]
+        value: String,
+    }
+
+    #[test]
+    fn cr_in_text_content() {
+        let value = Value {
+            value: "hello\rworld".into(),
+        };
+        let xml = to_string(&value).unwrap();
+        assert_eq!(xml, "<value>hello&#13;world</value>");
+        let roundtripped: Value = from_str(&xml).unwrap();
+        assert_eq!(roundtripped, value);
+    }
+
+    #[test]
+    fn cr_lf_in_text_content() {
+        let value = Value {
+            value: "hello\r\nworld".into(),
+        };
+        let xml = to_string(&value).unwrap();
+        assert_eq!(xml, "<value>hello&#13;\nworld</value>");
+        let roundtripped: Value = from_str(&xml).unwrap();
+        assert_eq!(roundtripped, value);
+    }
+
+    #[test]
+    fn lf_in_text_content_not_escaped() {
+        let value = Value {
+            value: "hello\nworld".into(),
+        };
+        let xml = to_string(&value).unwrap();
+        // \n is valid in text content and not subject to EOL normalization,
+        // so it should NOT be escaped
+        assert_eq!(xml, "<value>hello\nworld</value>");
+        let roundtripped: Value = from_str(&xml).unwrap();
+        assert_eq!(roundtripped, value);
+    }
+
+    /// CDATA sections cannot preserve `\r` because character references are
+    /// not permitted inside CDATA. This is an inherent XML limitation, the
+    /// round-trip is lossy in this case.
+    #[test]
+    fn cdata_cr_is_lossy() {
+        let mut buffer = String::new();
+        let mut ser = Serializer::with_root(&mut buffer, Some("value")).unwrap();
+        ser.text_format(quick_xml::se::TextFormat::CData);
+
+        let value = Value {
+            value: "hello\rworld".into(),
+        };
+        value.serialize(ser).unwrap();
+
+        // The serializer writes \r literally inside CDATA (it cannot escape it)
+        assert_eq!(buffer, "<value><![CDATA[hello\rworld]]></value>");
+
+        // But XML EOL normalization converts \r to \n on parse, so round-trip
+        // produces \n instead of \r
+        let parsed: Value = from_str(&buffer).unwrap();
+        assert_eq!(parsed.value, "hello\nworld");
+        assert_ne!(parsed, value);
+    }
+
+    /// CDATA with CRLF is also lossy: \r\n becomes \n.
+    #[test]
+    fn cdata_cr_lf_is_lossy() {
+        let mut buffer = String::new();
+        let mut ser = Serializer::with_root(&mut buffer, Some("value")).unwrap();
+        ser.text_format(quick_xml::se::TextFormat::CData);
+
+        let value = Value {
+            value: "hello\r\nworld".into(),
+        };
+        value.serialize(ser).unwrap();
+
+        assert_eq!(buffer, "<value><![CDATA[hello\r\nworld]]></value>");
+
+        let parsed: Value = from_str(&buffer).unwrap();
+        assert_eq!(parsed.value, "hello\nworld");
+    }
+}