From 6a516d287e3bf012e50340f3f47d4627e5cec5d0 Mon Sep 17 00:00:00 2001
From: nerdsane <nerdsane.sh@gmail.com>
Date: Wed, 22 Jul 2026 00:22:58 -0500
Subject: [PATCH 1/2] Decode XML entity references when reading CSDL attributes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`attr_str` returned `Attribute::value` verbatim, which is the raw,
still-escaped byte range. Any CSDL containing `&amp;`, `&quot;` or a
numeric character reference in an attribute therefore parsed into the
typed model as the literal escape text rather than the character it
denotes.

This is load-bearing for the emitter escaping that follows: with the
emitter escaping correctly and the parser not unescaping, every
parse/emit/parse cycle would add a layer (`&` -> `&amp;` -> `&amp;amp;`).
The two changes are only correct together.

No existing behaviour changes for the current corpus — no CSDL fixture
in the repository contains an entity reference — so this commit is a
no-op for the suite and is separated purely to keep the shared read-path
change reviewable on its own.

Refs ARN-237.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 crates/temper-spec/src/csdl/parser/xml.rs | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/crates/temper-spec/src/csdl/parser/xml.rs b/crates/temper-spec/src/csdl/parser/xml.rs
index b8dc630f4..880611eff 100644
--- a/crates/temper-spec/src/csdl/parser/xml.rs
+++ b/crates/temper-spec/src/csdl/parser/xml.rs
@@ -38,12 +38,18 @@ pub(super) fn local_name_end(element: &BytesEnd) -> String {
     full.rsplit(':').next().unwrap_or(full).to_string()
 }
 
+/// Read an attribute, decoding XML entity and character references.
+///
+/// `Attribute::value` is the raw, still-escaped bytes. Returning those directly
+/// would surface `&amp;` and `&#xA;` as literal text and make parse/emit/parse
+/// double-escape, so the value is unescaped here.
 pub(super) fn attr_str(element: &BytesStart, name: &str) -> Option<String> {
     element
         .attributes()
         .flatten()
         .find(|attribute| std::str::from_utf8(attribute.key.as_ref()).unwrap_or("") == name)
-        .and_then(|attribute| String::from_utf8(attribute.value.to_vec()).ok())
+        .and_then(|attribute| attribute.unescape_value().ok())
+        .map(|value| value.into_owned())
 }
 
 pub(super) fn required_attr(element: &BytesStart, name: &str) -> Result<String, CsdlParseError> {

From a5e80530f43f89faa5e8cb405f83a56c4c2b627a Mon Sep 17 00:00:00 2001
From: nerdsane <nerdsane.sh@gmail.com>
Date: Wed, 22 Jul 2026 00:23:38 -0500
Subject: [PATCH 2/2] Escape every attribute value emitted in CSDL metadata
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`emit_csdl_xml` applied `xml_escape` to only 4 of roughly 30
interpolation sites. Names, types, namespaces, DefaultValue,
navigation-binding Path/Target, action/function references and
annotation terms were all written into attributes verbatim. Those values
are agent- and user-influenced, so a `"` in an identifier closed the
attribute and let the remainder of the value inject arbitrary markup —
the same defect class as ARN-172. A property named

    Name"/><Property Name="Smuggled

produced a second, unintended property element, and a smuggled
`HasStream="true"` altered the typed model on re-parse.

Every interpolated string value now passes through `xml_escape`. The
remaining unescaped interpolations are numeric (`i64`, `u32`, `f64`,
`bool`) and cannot produce a metacharacter.

`xml_escape` additionally escapes tab, newline and carriage return as
character references. XML attribute-value normalisation replaces literal
occurrences with spaces, so without this a multi-line DefaultValue or
Description came back altered even when the quoting was correct. The
function is also now a single pass rather than five chained `replace`
calls.

Tests cover both properties: `adversarial_identifiers_do_not_inject_markup`
asserts that no live markup is emitted and that the typed model survives
a round trip unchanged, across entity types, keys, properties,
annotations, containers, entity sets, navigation bindings and
action/function imports; `whitespace_in_attribute_values_round_trips`
pins the normalisation behaviour.

This is the emitter half of ARN-237. The strict-parsing half — rejecting
truncated schemas, mandatory attributes, unknown-element rejection — is
deliberately deferred: it increases the set of persisted schemas that
fail to load, which interacts directly with ARN-190, where one corrupt
tenant CSDL aborts the entire registry restore.

Refs ARN-237.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 crates/temper-spec/src/csdl/emit.rs      | 230 ++++++++------------
 crates/temper-spec/src/csdl/emit_test.rs | 261 +++++++++++++++++++++++
 2 files changed, 353 insertions(+), 138 deletions(-)
 create mode 100644 crates/temper-spec/src/csdl/emit_test.rs

diff --git a/crates/temper-spec/src/csdl/emit.rs b/crates/temper-spec/src/csdl/emit.rs
index 1ea494e9e..a5a2d69ae 100644
--- a/crates/temper-spec/src/csdl/emit.rs
+++ b/crates/temper-spec/src/csdl/emit.rs
@@ -10,7 +10,7 @@ pub fn emit_csdl_xml(doc: &CsdlDocument) -> String {
     let mut out = String::from("<?xml version=\"1.0\" encoding=\"utf-8\"?>\n");
     out.push_str(&format!(
         "<edmx:Edmx Version=\"{}\" xmlns:edmx=\"http://docs.oasis-open.org/odata/ns/edmx\">\n",
-        doc.version
+        xml_escape(&doc.version)
     ));
     out.push_str("  <edmx:DataServices>\n");
 
@@ -26,7 +26,7 @@ pub fn emit_csdl_xml(doc: &CsdlDocument) -> String {
 fn emit_schema(out: &mut String, schema: &Schema) {
     out.push_str(&format!(
         "    <Schema Namespace=\"{}\" xmlns=\"http://docs.oasis-open.org/odata/ns/edm\">\n",
-        schema.namespace
+        xml_escape(&schema.namespace)
     ));
 
     for term in &schema.terms {
@@ -54,10 +54,11 @@ fn emit_schema(out: &mut String, schema: &Schema) {
 fn emit_term(out: &mut String, term: &Term) {
     out.push_str(&format!(
         "      <Term Name=\"{}\" Type=\"{}\"",
-        term.name, term.type_name
+        xml_escape(&term.name),
+        xml_escape(&term.type_name)
     ));
     if let Some(ref applies_to) = term.applies_to {
-        out.push_str(&format!(" AppliesTo=\"{applies_to}\""));
+        out.push_str(&format!(" AppliesTo=\"{}\"", xml_escape(applies_to)));
     }
     if let Some(ref description) = term.description {
         out.push_str(&format!(" Description=\"{}\"", xml_escape(description)));
@@ -66,15 +67,22 @@ fn emit_term(out: &mut String, term: &Term) {
 }
 
 fn emit_enum_type(out: &mut String, et: &EnumType) {
-    out.push_str(&format!("      <EnumType Name=\"{}\">\n", et.name));
+    out.push_str(&format!(
+        "      <EnumType Name=\"{}\">\n",
+        xml_escape(&et.name)
+    ));
     for member in &et.members {
         if let Some(val) = member.value {
             out.push_str(&format!(
                 "        <Member Name=\"{}\" Value=\"{}\"/>\n",
-                member.name, val
+                xml_escape(&member.name),
+                val
             ));
         } else {
-            out.push_str(&format!("        <Member Name=\"{}\"/>\n", member.name));
+            out.push_str(&format!(
+                "        <Member Name=\"{}\"/>\n",
+                xml_escape(&member.name)
+            ));
         }
     }
     out.push_str("      </EnumType>\n");
@@ -84,17 +92,23 @@ fn emit_entity_type(out: &mut String, et: &EntityType) {
     if et.has_stream {
         out.push_str(&format!(
             "      <EntityType Name=\"{}\" HasStream=\"true\">\n",
-            et.name
+            xml_escape(&et.name)
         ));
     } else {
-        out.push_str(&format!("      <EntityType Name=\"{}\">\n", et.name));
+        out.push_str(&format!(
+            "      <EntityType Name=\"{}\">\n",
+            xml_escape(&et.name)
+        ));
     }
 
     // Key
     if !et.key_properties.is_empty() {
         out.push_str("        <Key>\n");
         for key in &et.key_properties {
-            out.push_str(&format!("          <PropertyRef Name=\"{key}\"/>\n"));
+            out.push_str(&format!(
+                "          <PropertyRef Name=\"{}\"/>\n",
+                xml_escape(key)
+            ));
         }
         out.push_str("        </Key>\n");
     }
@@ -120,13 +134,14 @@ fn emit_entity_type(out: &mut String, et: &EntityType) {
 fn emit_property(out: &mut String, prop: &Property) {
     out.push_str(&format!(
         "        <Property Name=\"{}\" Type=\"{}\"",
-        prop.name, prop.type_name
+        xml_escape(&prop.name),
+        xml_escape(&prop.type_name)
     ));
     if !prop.nullable {
         out.push_str(" Nullable=\"false\"");
     }
     if let Some(ref default) = prop.default_value {
-        out.push_str(&format!(" DefaultValue=\"{default}\""));
+        out.push_str(&format!(" DefaultValue=\"{}\"", xml_escape(default)));
     }
     if let Some(precision) = prop.precision {
         out.push_str(&format!(" Precision=\"{precision}\""));
@@ -142,7 +157,8 @@ fn emit_navigation_property(out: &mut String, nav: &NavigationProperty) {
 
     out.push_str(&format!(
         "        <NavigationProperty Name=\"{}\" Type=\"{}\"",
-        nav.name, nav.type_name
+        xml_escape(&nav.name),
+        xml_escape(&nav.type_name)
     ));
     if !nav.nullable {
         out.push_str(" Nullable=\"false\"");
@@ -156,7 +172,8 @@ fn emit_navigation_property(out: &mut String, nav: &NavigationProperty) {
         for rc in &nav.referential_constraints {
             out.push_str(&format!(
                 "          <ReferentialConstraint Property=\"{}\" ReferencedProperty=\"{}\"/>\n",
-                rc.property, rc.referenced_property
+                xml_escape(&rc.property),
+                xml_escape(&rc.referenced_property)
             ));
         }
         out.push_str("        </NavigationProperty>\n");
@@ -170,7 +187,10 @@ fn emit_action(out: &mut String, action: &Action) {
         || action.return_type.is_some()
         || !action.annotations.is_empty();
 
-    out.push_str(&format!("      <Action Name=\"{}\"", action.name));
+    out.push_str(&format!(
+        "      <Action Name=\"{}\"",
+        xml_escape(&action.name)
+    ));
     if action.is_bound {
         out.push_str(" IsBound=\"true\"");
     }
@@ -196,7 +216,10 @@ fn emit_function(out: &mut String, func: &Function) {
     let has_children =
         !func.parameters.is_empty() || func.return_type.is_some() || !func.annotations.is_empty();
 
-    out.push_str(&format!("      <Function Name=\"{}\"", func.name));
+    out.push_str(&format!(
+        "      <Function Name=\"{}\"",
+        xml_escape(&func.name)
+    ));
     if func.is_bound {
         out.push_str(" IsBound=\"true\"");
     }
@@ -221,19 +244,23 @@ fn emit_function(out: &mut String, func: &Function) {
 fn emit_parameter(out: &mut String, param: &Parameter) {
     out.push_str(&format!(
         "        <Parameter Name=\"{}\" Type=\"{}\"",
-        param.name, param.type_name
+        xml_escape(&param.name),
+        xml_escape(&param.type_name)
     ));
     if !param.nullable {
         out.push_str(" Nullable=\"false\"");
     }
     if let Some(ref default) = param.default_value {
-        out.push_str(&format!(" DefaultValue=\"{default}\""));
+        out.push_str(&format!(" DefaultValue=\"{}\"", xml_escape(default)));
     }
     out.push_str("/>\n");
 }
 
 fn emit_return_type(out: &mut String, rt: &ReturnType) {
-    out.push_str(&format!("        <ReturnType Type=\"{}\"", rt.type_name));
+    out.push_str(&format!(
+        "        <ReturnType Type=\"{}\"",
+        xml_escape(&rt.type_name)
+    ));
     if !rt.nullable {
         out.push_str(" Nullable=\"false\"");
     }
@@ -253,7 +280,7 @@ fn emit_entity_container(out: &mut String, container: &EntityContainer) {
 
     out.push_str(&format!(
         "      <EntityContainer Name=\"{}\"",
-        container.name
+        xml_escape(&container.name)
     ));
 
     if has_children {
@@ -264,13 +291,15 @@ fn emit_entity_container(out: &mut String, container: &EntityContainer) {
         for ai in &container.action_imports {
             out.push_str(&format!(
                 "        <ActionImport Name=\"{}\" Action=\"{}\"/>\n",
-                ai.name, ai.action
+                xml_escape(&ai.name),
+                xml_escape(&ai.action)
             ));
         }
         for fi in &container.function_imports {
             out.push_str(&format!(
                 "        <FunctionImport Name=\"{}\" Function=\"{}\"/>\n",
-                fi.name, fi.function
+                xml_escape(&fi.name),
+                xml_escape(&fi.function)
             ));
         }
         out.push_str("      </EntityContainer>\n");
@@ -283,17 +312,20 @@ fn emit_entity_set(out: &mut String, es: &EntitySet) {
     if es.navigation_bindings.is_empty() {
         out.push_str(&format!(
             "        <EntitySet Name=\"{}\" EntityType=\"{}\"/>\n",
-            es.name, es.entity_type
+            xml_escape(&es.name),
+            xml_escape(&es.entity_type)
         ));
     } else {
         out.push_str(&format!(
             "        <EntitySet Name=\"{}\" EntityType=\"{}\">\n",
-            es.name, es.entity_type
+            xml_escape(&es.name),
+            xml_escape(&es.entity_type)
         ));
         for nb in &es.navigation_bindings {
             out.push_str(&format!(
                 "          <NavigationPropertyBinding Path=\"{}\" Target=\"{}\"/>\n",
-                nb.path, nb.target
+                xml_escape(&nb.path),
+                xml_escape(&nb.target)
             ));
         }
         out.push_str("        </EntitySet>\n");
@@ -302,34 +334,35 @@ fn emit_entity_set(out: &mut String, es: &EntitySet) {
 
 fn emit_annotation(out: &mut String, ann: &Annotation, indent: usize) {
     let pad: String = " ".repeat(indent);
+    let term = xml_escape(&ann.term);
     match &ann.value {
         AnnotationValue::String(s) => {
             out.push_str(&format!(
                 "{pad}<Annotation Term=\"{}\" String=\"{}\"/>\n",
-                ann.term,
+                term,
                 xml_escape(s)
             ));
         }
         AnnotationValue::Float(f) => {
             out.push_str(&format!(
                 "{pad}<Annotation Term=\"{}\" Float=\"{f}\"/>\n",
-                ann.term
+                term
             ));
         }
         AnnotationValue::Bool(b) => {
             out.push_str(&format!(
                 "{pad}<Annotation Term=\"{}\" Bool=\"{b}\"/>\n",
-                ann.term
+                term
             ));
         }
         AnnotationValue::Int(i) => {
             out.push_str(&format!(
                 "{pad}<Annotation Term=\"{}\" Int=\"{i}\"/>\n",
-                ann.term
+                term
             ));
         }
         AnnotationValue::Collection(items) => {
-            out.push_str(&format!("{pad}<Annotation Term=\"{}\">\n", ann.term));
+            out.push_str(&format!("{pad}<Annotation Term=\"{term}\">\n"));
             out.push_str(&format!("{pad}  <Collection>\n"));
             for item in items {
                 out.push_str(&format!("{pad}    <String>{}</String>\n", xml_escape(item)));
@@ -338,11 +371,12 @@ fn emit_annotation(out: &mut String, ann: &Annotation, indent: usize) {
             out.push_str(&format!("{pad}</Annotation>\n"));
         }
         AnnotationValue::Record(map) => {
-            out.push_str(&format!("{pad}<Annotation Term=\"{}\">\n", ann.term));
+            out.push_str(&format!("{pad}<Annotation Term=\"{term}\">\n"));
             out.push_str(&format!("{pad}  <Record>\n"));
             for (k, v) in map {
                 out.push_str(&format!(
-                    "{pad}    <PropertyValue Property=\"{k}\" String=\"{}\"/>\n",
+                    "{pad}    <PropertyValue Property=\"{}\" String=\"{}\"/>\n",
+                    xml_escape(k),
                     xml_escape(v)
                 ));
             }
@@ -353,113 +387,33 @@ fn emit_annotation(out: &mut String, ann: &Annotation, indent: usize) {
 }
 
 /// Escape XML special characters in attribute/text values.
+///
+/// Every value interpolated into emitted CSDL must pass through this function —
+/// identifiers included. Names, types, and references are agent- or
+/// user-influenced, so an unescaped `"` there closes the attribute and lets the
+/// value inject arbitrary markup.
+///
+/// Tab, newline, and carriage return are escaped as character references
+/// because XML attribute-value normalization would otherwise replace them with
+/// spaces, silently changing the value on the way back in.
 fn xml_escape(s: &str) -> String {
-    s.replace('&', "&amp;")
-        .replace('<', "&lt;")
-        .replace('>', "&gt;")
-        .replace('"', "&quot;")
-        .replace('\'', "&apos;")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::csdl::parse_csdl;
-
-    #[test]
-    fn emit_round_trips_minimal_csdl() {
-        let xml = r#"<?xml version="1.0"?>
-        <edmx:Edmx Version="4.0" xmlns:edmx="http://docs.oasis-open.org/odata/ns/edmx">
-          <edmx:DataServices>
-            <Schema Namespace="Test" xmlns="http://docs.oasis-open.org/odata/ns/edm">
-              <EntityType Name="Widget">
-                <Key><PropertyRef Name="Id"/></Key>
-                <Property Name="Id" Type="Edm.Guid" Nullable="false"/>
-                <Property Name="Name" Type="Edm.String"/>
-              </EntityType>
-              <EntityContainer Name="Svc">
-                <EntitySet Name="Widgets" EntityType="Test.Widget"/>
-              </EntityContainer>
-            </Schema>
-          </edmx:DataServices>
-        </edmx:Edmx>"#;
-
-        let doc = parse_csdl(xml).unwrap();
-        let emitted = emit_csdl_xml(&doc);
-
-        // Parse the emitted XML back and verify structure is preserved.
-        let doc2 = parse_csdl(&emitted).expect("emitted XML should re-parse");
-        assert_eq!(doc2.version, "4.0");
-        assert_eq!(doc2.schemas.len(), 1);
-        let schema = &doc2.schemas[0];
-        assert_eq!(schema.namespace, "Test");
-        assert_eq!(schema.entity_types.len(), 1);
-        assert_eq!(schema.entity_types[0].name, "Widget");
-        assert_eq!(schema.entity_types[0].key_properties, vec!["Id"]);
-        assert_eq!(schema.entity_types[0].properties.len(), 2);
-        assert_eq!(schema.entity_containers.len(), 1);
-        assert_eq!(schema.entity_containers[0].entity_sets.len(), 1);
-        assert_eq!(
-            schema.entity_containers[0].entity_sets[0].entity_type,
-            "Test.Widget"
-        );
-    }
-
-    #[test]
-    fn emit_round_trips_has_stream() {
-        let xml = r#"<?xml version="1.0"?>
-        <edmx:Edmx Version="4.0" xmlns:edmx="http://docs.oasis-open.org/odata/ns/edmx">
-          <edmx:DataServices>
-            <Schema Namespace="Test" xmlns="http://docs.oasis-open.org/odata/ns/edm">
-              <EntityType Name="MediaFile" HasStream="true">
-                <Key><PropertyRef Name="Id"/></Key>
-                <Property Name="Id" Type="Edm.Guid" Nullable="false"/>
-                <Property Name="Name" Type="Edm.String"/>
-              </EntityType>
-              <EntityType Name="RegularEntity">
-                <Key><PropertyRef Name="Id"/></Key>
-                <Property Name="Id" Type="Edm.Guid" Nullable="false"/>
-              </EntityType>
-            </Schema>
-          </edmx:DataServices>
-        </edmx:Edmx>"#;
-
-        let doc = parse_csdl(xml).unwrap();
-        let schema = &doc.schemas[0];
-
-        let media = schema.entity_type("MediaFile").unwrap();
-        assert!(media.has_stream, "MediaFile should have has_stream=true");
-
-        let regular = schema.entity_type("RegularEntity").unwrap();
-        assert!(
-            !regular.has_stream,
-            "RegularEntity should have has_stream=false"
-        );
-
-        // Round-trip
-        let emitted = emit_csdl_xml(&doc);
-        let doc2 = parse_csdl(&emitted).unwrap();
-        let schema2 = &doc2.schemas[0];
-
-        assert!(schema2.entity_type("MediaFile").unwrap().has_stream);
-        assert!(!schema2.entity_type("RegularEntity").unwrap().has_stream);
-    }
-
-    #[test]
-    fn emit_round_trips_reference_csdl() {
-        let xml = include_str!("../../../../test-fixtures/specs/model.csdl.xml");
-        let doc = parse_csdl(xml).unwrap();
-        let emitted = emit_csdl_xml(&doc);
-
-        let doc2 = parse_csdl(&emitted).expect("emitted reference CSDL should re-parse");
-        assert_eq!(doc2.schemas.len(), doc.schemas.len());
-
-        // Verify entity types are preserved.
-        for (s1, s2) in doc.schemas.iter().zip(doc2.schemas.iter()) {
-            assert_eq!(s1.namespace, s2.namespace);
-            assert_eq!(s1.entity_types.len(), s2.entity_types.len());
-            assert_eq!(s1.actions.len(), s2.actions.len());
-            assert_eq!(s1.entity_containers.len(), s2.entity_containers.len());
+    let mut out = String::with_capacity(s.len());
+    for ch in s.chars() {
+        match ch {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&apos;"),
+            '\t' => out.push_str("&#x9;"),
+            '\n' => out.push_str("&#xA;"),
+            '\r' => out.push_str("&#xD;"),
+            _ => out.push(ch),
         }
     }
+    out
 }
+
+#[cfg(test)]
+#[path = "emit_test.rs"]
+mod tests;
diff --git a/crates/temper-spec/src/csdl/emit_test.rs b/crates/temper-spec/src/csdl/emit_test.rs
new file mode 100644
index 000000000..1880fd3a2
--- /dev/null
+++ b/crates/temper-spec/src/csdl/emit_test.rs
@@ -0,0 +1,261 @@
+use super::*;
+use crate::csdl::parse_csdl;
+
+#[test]
+fn emit_round_trips_minimal_csdl() {
+    let xml = r#"<?xml version="1.0"?>
+    <edmx:Edmx Version="4.0" xmlns:edmx="http://docs.oasis-open.org/odata/ns/edmx">
+      <edmx:DataServices>
+        <Schema Namespace="Test" xmlns="http://docs.oasis-open.org/odata/ns/edm">
+          <EntityType Name="Widget">
+            <Key><PropertyRef Name="Id"/></Key>
+            <Property Name="Id" Type="Edm.Guid" Nullable="false"/>
+            <Property Name="Name" Type="Edm.String"/>
+          </EntityType>
+          <EntityContainer Name="Svc">
+            <EntitySet Name="Widgets" EntityType="Test.Widget"/>
+          </EntityContainer>
+        </Schema>
+      </edmx:DataServices>
+    </edmx:Edmx>"#;
+
+    let doc = parse_csdl(xml).unwrap();
+    let emitted = emit_csdl_xml(&doc);
+
+    // Parse the emitted XML back and verify structure is preserved.
+    let doc2 = parse_csdl(&emitted).expect("emitted XML should re-parse");
+    assert_eq!(doc2.version, "4.0");
+    assert_eq!(doc2.schemas.len(), 1);
+    let schema = &doc2.schemas[0];
+    assert_eq!(schema.namespace, "Test");
+    assert_eq!(schema.entity_types.len(), 1);
+    assert_eq!(schema.entity_types[0].name, "Widget");
+    assert_eq!(schema.entity_types[0].key_properties, vec!["Id"]);
+    assert_eq!(schema.entity_types[0].properties.len(), 2);
+    assert_eq!(schema.entity_containers.len(), 1);
+    assert_eq!(schema.entity_containers[0].entity_sets.len(), 1);
+    assert_eq!(
+        schema.entity_containers[0].entity_sets[0].entity_type,
+        "Test.Widget"
+    );
+}
+
+#[test]
+fn emit_round_trips_has_stream() {
+    let xml = r#"<?xml version="1.0"?>
+    <edmx:Edmx Version="4.0" xmlns:edmx="http://docs.oasis-open.org/odata/ns/edmx">
+      <edmx:DataServices>
+        <Schema Namespace="Test" xmlns="http://docs.oasis-open.org/odata/ns/edm">
+          <EntityType Name="MediaFile" HasStream="true">
+            <Key><PropertyRef Name="Id"/></Key>
+            <Property Name="Id" Type="Edm.Guid" Nullable="false"/>
+            <Property Name="Name" Type="Edm.String"/>
+          </EntityType>
+          <EntityType Name="RegularEntity">
+            <Key><PropertyRef Name="Id"/></Key>
+            <Property Name="Id" Type="Edm.Guid" Nullable="false"/>
+          </EntityType>
+        </Schema>
+      </edmx:DataServices>
+    </edmx:Edmx>"#;
+
+    let doc = parse_csdl(xml).unwrap();
+    let schema = &doc.schemas[0];
+
+    let media = schema.entity_type("MediaFile").unwrap();
+    assert!(media.has_stream, "MediaFile should have has_stream=true");
+
+    let regular = schema.entity_type("RegularEntity").unwrap();
+    assert!(
+        !regular.has_stream,
+        "RegularEntity should have has_stream=false"
+    );
+
+    // Round-trip
+    let emitted = emit_csdl_xml(&doc);
+    let doc2 = parse_csdl(&emitted).unwrap();
+    let schema2 = &doc2.schemas[0];
+
+    assert!(schema2.entity_type("MediaFile").unwrap().has_stream);
+    assert!(!schema2.entity_type("RegularEntity").unwrap().has_stream);
+}
+
+/// A property name carrying a quote must not be able to close the attribute
+/// and inject markup of its own.
+#[test]
+fn adversarial_identifiers_do_not_inject_markup() {
+    let doc = CsdlDocument {
+        version: "4.0".to_string(),
+        schemas: vec![Schema {
+            namespace: "Ns\"><Injected/><Schema Namespace=\"Evil".to_string(),
+            entity_types: vec![EntityType {
+                name: "Widget\" HasStream=\"true".to_string(),
+                key_properties: vec!["Id<&>".to_string()],
+                properties: vec![Property {
+                    name: "Name\"/><Property Name=\"Smuggled".to_string(),
+                    type_name: "Edm.String".to_string(),
+                    nullable: true,
+                    default_value: Some("a\"b&c<d".to_string()),
+                    precision: None,
+                    scale: None,
+                }],
+                navigation_properties: Vec::new(),
+                annotations: vec![Annotation {
+                    term: "Ns.Term\"><Injected/><Annotation Term=\"Evil".to_string(),
+                    value: AnnotationValue::String("v\"><Injected/>".to_string()),
+                }],
+                has_stream: false,
+            }],
+            enum_types: Vec::new(),
+            actions: Vec::new(),
+            functions: Vec::new(),
+            entity_containers: vec![EntityContainer {
+                name: "Svc\"><Injected/><EntityContainer Name=\"Evil".to_string(),
+                entity_sets: vec![EntitySet {
+                    name: "Widgets\"><Injected/>".to_string(),
+                    entity_type: "Test.Widget\"><Injected/>".to_string(),
+                    navigation_bindings: vec![NavigationBinding {
+                        path: "Path\"><Injected/>".to_string(),
+                        target: "Target\"><Injected/>".to_string(),
+                    }],
+                }],
+                action_imports: vec![ActionImport {
+                    name: "DoIt\"><Injected/>".to_string(),
+                    action: "Test.DoIt\"><Injected/>".to_string(),
+                }],
+                function_imports: vec![FunctionImport {
+                    name: "GetIt\"><Injected/>".to_string(),
+                    function: "Test.GetIt\"><Injected/>".to_string(),
+                }],
+            }],
+            terms: Vec::new(),
+        }],
+    };
+
+    let emitted = emit_csdl_xml(&doc);
+    // The adversarial substrings may legitimately appear *escaped* inside an
+    // attribute value; what must never appear is live markup.
+    assert!(
+        !emitted.contains("<Injected/>"),
+        "namespace escaped its attribute:\n{emitted}"
+    );
+    assert!(
+        !emitted.contains("<Property Name=\"Smuggled"),
+        "property name injected a sibling element:\n{emitted}"
+    );
+
+    let reparsed = parse_csdl(&emitted).expect("adversarial emit must stay well-formed");
+    let schema = &reparsed.schemas[0];
+    assert_eq!(schema.namespace, doc.schemas[0].namespace);
+    assert_eq!(
+        schema.entity_types.len(),
+        1,
+        "injection created extra entity types"
+    );
+
+    let entity_type = &schema.entity_types[0];
+    let original = &doc.schemas[0].entity_types[0];
+    assert_eq!(entity_type.name, original.name);
+    assert!(
+        !entity_type.has_stream,
+        "smuggled HasStream=\"true\" changed the typed model"
+    );
+    assert_eq!(entity_type.key_properties, original.key_properties);
+    assert_eq!(entity_type.properties.len(), 1);
+    assert_eq!(entity_type.properties[0].name, original.properties[0].name);
+    assert_eq!(
+        entity_type.properties[0].default_value,
+        original.properties[0].default_value
+    );
+
+    assert_eq!(entity_type.annotations.len(), 1);
+    assert_eq!(
+        entity_type.annotations[0].term,
+        original.annotations[0].term
+    );
+
+    // Container-side identifiers were unescaped before this fix too, so pin
+    // them against regression rather than trusting the emitter by symmetry.
+    assert_eq!(
+        schema.entity_containers.len(),
+        1,
+        "injection created extra entity containers"
+    );
+    let container = &schema.entity_containers[0];
+    let original_container = &doc.schemas[0].entity_containers[0];
+    assert_eq!(container.name, original_container.name);
+
+    assert_eq!(container.entity_sets.len(), 1);
+    let entity_set = &container.entity_sets[0];
+    let original_set = &original_container.entity_sets[0];
+    assert_eq!(entity_set.name, original_set.name);
+    assert_eq!(entity_set.entity_type, original_set.entity_type);
+
+    assert_eq!(entity_set.navigation_bindings.len(), 1);
+    assert_eq!(
+        entity_set.navigation_bindings[0].path,
+        original_set.navigation_bindings[0].path
+    );
+    assert_eq!(
+        entity_set.navigation_bindings[0].target,
+        original_set.navigation_bindings[0].target
+    );
+
+    assert_eq!(container.action_imports.len(), 1);
+    assert_eq!(
+        container.action_imports[0].action,
+        original_container.action_imports[0].action
+    );
+    assert_eq!(container.function_imports.len(), 1);
+    assert_eq!(
+        container.function_imports[0].function,
+        original_container.function_imports[0].function
+    );
+}
+
+/// Whitespace inside attribute values survives the round trip rather than
+/// being collapsed by attribute-value normalization.
+#[test]
+fn whitespace_in_attribute_values_round_trips() {
+    let doc = CsdlDocument {
+        version: "4.0".to_string(),
+        schemas: vec![Schema {
+            namespace: "Test".to_string(),
+            entity_types: Vec::new(),
+            enum_types: Vec::new(),
+            actions: Vec::new(),
+            functions: Vec::new(),
+            entity_containers: Vec::new(),
+            terms: vec![Term {
+                name: "Note".to_string(),
+                type_name: "Edm.String".to_string(),
+                applies_to: None,
+                description: Some("line one\nline\ttwo\rend".to_string()),
+            }],
+        }],
+    };
+
+    let reparsed = parse_csdl(&emit_csdl_xml(&doc)).expect("emitted XML should re-parse");
+    assert_eq!(
+        reparsed.schemas[0].terms[0].description,
+        doc.schemas[0].terms[0].description
+    );
+}
+
+#[test]
+fn emit_round_trips_reference_csdl() {
+    let xml = include_str!("../../../../test-fixtures/specs/model.csdl.xml");
+    let doc = parse_csdl(xml).unwrap();
+    let emitted = emit_csdl_xml(&doc);
+
+    let doc2 = parse_csdl(&emitted).expect("emitted reference CSDL should re-parse");
+    assert_eq!(doc2.schemas.len(), doc.schemas.len());
+
+    // Verify entity types are preserved.
+    for (s1, s2) in doc.schemas.iter().zip(doc2.schemas.iter()) {
+        assert_eq!(s1.namespace, s2.namespace);
+        assert_eq!(s1.entity_types.len(), s2.entity_types.len());
+        assert_eq!(s1.actions.len(), s2.actions.len());
+        assert_eq!(s1.entity_containers.len(), s2.entity_containers.len());
+    }
+}