Mailing-List: contact issues-help@commons.apache.org; run by ezmlm
Precedence: bulk
Reply-To: issues@commons.apache.org
Date: Sat, 25 Oct 2014 02:49:35 +0000 (UTC)
From: "Bruno P. Kinoshita (JIRA)" <jira@apache.org>
To: issues@commons.apache.org
Message-ID: <JIRA.12746574.1412730059000.337046.1414205375090@Atlassian.JIRA>
In-Reply-To: <JIRA.12746574.1412730059000@Atlassian.JIRA>
References: <JIRA.12746574.1412730059000@Atlassian.JIRA>
 <JIRA.12746574.1412730059430@arcas>
Subject: [jira] [Commented] (LANG-1042) StringEscapeUtils.escapeHtml() does
 not escape single quote
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


    [ https://issues.apache.org/jira/browse/LANG-1042?page=3Dcom.atlassian.=
jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D14183=
879#comment-14183879 ]=20

Bruno P. Kinoshita commented on LANG-1042:
------------------------------------------

> Duncan: Have a good think about the current functionality, then document =
it better so that people truly understand what it does and in which context=
s it is useful (if any).

+1=20

> Robert: what about deprecating this method and introducing a new one =E2=
=80=93 secureHtmlEscape =E2=80=93 that escapes <, >, ', ", and &?

+0

I think adding a secureHtmlEscape method could fix this issue, but I'm not =
sure if that wouldn't mean that we could have further variations or methods=
 for XML, HTML or other formats.

> StringEscapeUtils.escapeHtml() does not escape single quote
> -----------------------------------------------------------
>
>                 Key: LANG-1042
>                 URL: https://issues.apache.org/jira/browse/LANG-1042
>             Project: Commons Lang
>          Issue Type: Bug
>            Reporter: Robert Sussland
>            Priority: Critical
>
> The String Escape Utils should ensure that encoded data cannot escape fro=
m a string. However in HTML (starting with 1.0 and until the present), attr=
ibute values may be denoted by either single or double quotes. Therefore si=
ngle quotes need to be escaped just as much as double quotes.=20
> From the standard: http://www.w3.org/TR/html4/intro/sgmltut.html#h-3.2.2
> {quote}
> By default, SGML requires that all attribute values be delimited using ei=
ther double quotation marks (ASCII decimal 34) or single quotation marks (A=
SCII decimal 39). Single quote marks can be included within the attribute v=
alue when the value is delimited by double quote marks, and vice versa. Aut=
hors may also use numeric character references to represent double quotes (=
&amp;#34\;) and single quotes (&amp;#39\;). For double quotes authors can a=
lso use the character entity reference &amp;quot;.
> {quote}
> Note that there have been several bugs in the wild in which string encode=
rs use this library under the hood, and as a result fail to properly escape=
 html attributes in which user input is stored:
> <div title=3D'<%=3Duser_data%>'>Howdy</div>
> if user_data =3D ' onclick=3D'payload' '=20
> then an attacker can inject their code into the page even if the develope=
r is using the string escape utils to escape the user string.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)