Strip out illegal XML characters in escapeXMLString.

Closes #5119.

1 files changed, 6 insertions, 1 deletions

diff --git a/src/Text/Pandoc/XML.hs b/src/Text/Pandoc/XML.hs
index c46938d73..a96a63647 100644
--- a/src/Text/Pandoc/XML.hs
+++ b/src/Text/Pandoc/XML.hs
@@ -57,7 +57,12 @@ escapeCharForXML x = case x of
 
 -- | Escape string as needed for XML.  Entity references are not preserved.
 escapeStringForXML :: String -> String
-escapeStringForXML = concatMap escapeCharForXML
+escapeStringForXML = concatMap escapeCharForXML . filter isLegalXMLChar
+  where isLegalXMLChar c = c == '\t' || c == '\n' || c == '\r' ||
+                           (c >= '\x20' && c <= '\xD7FF') ||
+                           (c >= '\xE000' && c <= '\xFFFD') ||
+                           (c >= '\x10000' && c <= '\x10FFFF')
+  -- see https://www.w3.org/TR/xml/#charsets
 
 -- | Escape newline characters as &#10;
 escapeNls :: String -> String