OPEN - issue SEC-966: Consider adding escapeXml attribute to security:authentication

http://jira.springframework.org/browse/SEC-966.  Added escaping of rendered text as default.

core/src/main/java/org/springframework/security/util/TextUtils.java

@@ -2,18 +2,22 @@ package org.springframework.security.util;
 
 /**
  * Utilities for working with Strings and text.
- * 
+ *
  * @author Luke Taylor
  * @version $Id$
  */
 public abstract class TextUtils {
 
     public static String escapeEntities(String s) {
+        if (s == null || s.length() == 0) {
+            return s;
+        }
+
         StringBuffer sb = new StringBuffer();
-        
+
         for (int i=0; i < s.length(); i++) {
             char c = s.charAt(i);
-            
+
             if(c == '<') {
                 sb.append("&lt;");
             } else if (c == '>') {
@@ -26,8 +30,8 @@ public abstract class TextUtils {
                 sb.append(c);
             }
         }
-        
+
         return sb.toString();
     }
-    
+
 }