BPMNAdapter: sanitize XML name attributes during import to preserve special-character labels

packages/extension/src/bpmn-elements-adapter/__tests__/adapter_in.test.js

@@ -525,4 +525,20 @@ describe('Test BPMNAdapter: import xml', () => {
       }),
     ).toEqual(graphData)
   })
+
+  it('should import shape names with special characters', () => {
+    const xmlWithSpecialName = xml.replace('name="开始"', 'name="A < B & C"')
+    const data = adapter.adapterXmlIn(xmlWithSpecialName)
+    expect(data.nodes.find((node) => node.id === 'Event_0rqndvp')?.text?.value).toBe(
+      'A < B & C',
+    )
+  })
+
+  it('should import mixed escaped and unescaped characters in shape names', () => {
+    const xmlWithMixedName = xml.replace('name="开始"', 'name="A &amp; B < C"')
+    const data = adapter.adapterXmlIn(xmlWithMixedName)
+    expect(data.nodes.find((node) => node.id === 'Event_0rqndvp')?.text?.value).toBe(
+      'A & B < C',
+    )
+  })
 })

packages/extension/src/bpmn-elements-adapter/index.ts

@@ -1119,8 +1119,21 @@ class BPMNAdapter extends BPMNBaseAdapter {
     lf.adapterOut = this.adapterXmlOut
     this.props = props
   }
+  private sanitizeNameAttributes(xml: string): string {
+    return xml.replace(/name="([^"]*)"/g, (_, val) => {
+      const safe = val
+        .replace(/&(?!#?\w+;)/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+      return `name="${safe}"`
+    })
+  }
   adapterXmlIn = (bpmnData: any) => {
-    const json = lfXml2Json(bpmnData)
+    const xmlData =
+      typeof bpmnData === 'string'
+        ? this.sanitizeNameAttributes(bpmnData)
+        : bpmnData
+    const json = lfXml2Json(xmlData)
     return this.adapterIn(json, this.props)
   }
   adapterXmlOut = (data: any) => {