Return-Path: <dev-return-68157-archive-asf-public=cust-asf.ponee.io@struts.apache.org>
X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io
Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io
Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183])
	by cust-asf2.ponee.io (Postfix) with ESMTP id CD119200BB8
	for <archive-asf-public-internal@cust-asf2.ponee.io>; Sat, 12 Nov 2016 09:25:11 +0100 (CET)
Received: by cust-asf.ponee.io (Postfix)
	id CB8AC160B15; Sat, 12 Nov 2016 08:25:11 +0000 (UTC)
Delivered-To: archive-asf-public@cust-asf.ponee.io
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by cust-asf.ponee.io (Postfix) with SMTP id 219E9160B00
	for <archive-asf-public@cust-asf.ponee.io>; Sat, 12 Nov 2016 09:25:10 +0100 (CET)
Received: (qmail 11374 invoked by uid 500); 12 Nov 2016 08:25:10 -0000
Mailing-List: contact dev-help@struts.apache.org; run by ezmlm
Precedence: bulk
List-Unsubscribe: <mailto:dev-unsubscribe@struts.apache.org>
List-Help: <mailto:dev-help@struts.apache.org>
List-Post: <mailto:dev@struts.apache.org>
List-Id: "Struts Developers List" <dev.struts.apache.org>
Reply-To: "Struts Developers List" <dev@struts.apache.org>
Delivered-To: mailing list dev@struts.apache.org
Received: (qmail 11363 invoked by uid 99); 12 Nov 2016 08:25:10 -0000
Received: from mail-relay.apache.org (HELO mail-relay.apache.org) (140.211.11.15)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 12 Nov 2016 08:25:10 +0000
Received: from mail-ua0-f176.google.com (mail-ua0-f176.google.com [209.85.217.176])
	by mail-relay.apache.org (ASF Mail Server at mail-relay.apache.org) with ESMTPSA id CD9131A0185
	for <dev@struts.apache.org>; Sat, 12 Nov 2016 08:25:09 +0000 (UTC)
Received: by mail-ua0-f176.google.com with SMTP id 20so30300630uak.0
        for <dev@struts.apache.org>; Sat, 12 Nov 2016 00:25:09 -0800 (PST)
X-Gm-Message-State: ABUngvd3OJVo9JO1LX7xmYRFCfuLBMgBxYKFfnwxFYORpILn+2vQvsygIEV9SOWERZN3AeQnDoA1AaUwLUL61w==
X-Received: by 10.159.48.145 with SMTP id j17mr3698114uab.43.1478939108751;
 Sat, 12 Nov 2016 00:25:08 -0800 (PST)
MIME-Version: 1.0
Received: by 10.31.193.72 with HTTP; Sat, 12 Nov 2016 00:24:48 -0800 (PST)
In-Reply-To: <CAJi=3dVqXj_7LStJO8gyeOikxnrDTkQ6u1DpD4XFBstDMYUUsQ@mail.gmail.com>
References: <02E2FF7B8822EF4E97F0F80E312226D4C10623@CA1-VPMSG-MBX02.TDY.Teledyne.com>
 <CAMopvkPB29vpQMHgkv6GbzrXTJnRokx1RNMRjCE7X=QctcOL-g@mail.gmail.com>
 <CAJi=3dWcevTDaSiku=g9nwOQTjWY7VsL29ku2CLtC3qFwnZ9tg@mail.gmail.com>
 <CAMopvkOcaZNS--HbAk0Z0+NZne=c1N4UDzEQ18Wz4AWf93MWSA@mail.gmail.com>
 <CAMopvkPDpeEqy+3WvCPRr0ZvqrnrG=V-t4bAQBhfd=PrT+Odpw@mail.gmail.com>
 <CAMopvkO590ap_uw=HyfLHmLA1wyMAsj1zoc+JDk3=9WTiEY9Gg@mail.gmail.com>
 <CAJi=3dU4u2TsW5k_OiER6izBeiXRc52r-icTVA02szX8GSS7iA@mail.gmail.com>
 <CAMopvkOqrm3py8kvqBcVPWD78EuNOcUxQ+24g-=b_H=9ABu69Q@mail.gmail.com>
 <CAJi=3dWPrrkQTZWRTf6pjdYgfgs9_=6gySP_npNJ4kfm-sojRA@mail.gmail.com>
 <CAMopvkOtQWM3i5PN5dxPv3Jp=XGLOKHGvjHb4JHvw4MXbN4t5w@mail.gmail.com>
 <CAJi=3dUJt-Sccz=m2evN9OTmyAUe0ac-36gg5-a8qpcBCHFSrA@mail.gmail.com>
 <CAMopvkMwr4qJG8NmRn29QTN937iRVKg-pP00vPZVdaXaWkrneg@mail.gmail.com> <CAJi=3dVqXj_7LStJO8gyeOikxnrDTkQ6u1DpD4XFBstDMYUUsQ@mail.gmail.com>
From: Lukasz Lenart <lukaszlenart@apache.org>
Date: Sat, 12 Nov 2016 09:24:48 +0100
X-Gmail-Original-Message-ID: <CAMopvkOXqYJxSUfJqjXXkd+3hmv3o7p6ddTF-L5ytMMEoGtCtQ@mail.gmail.com>
Message-ID: <CAMopvkOXqYJxSUfJqjXXkd+3hmv3o7p6ddTF-L5ytMMEoGtCtQ@mail.gmail.com>
Subject: Re: Referencing request parameters in struts tags.
To: Struts Developers List <dev@struts.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
archived-at: Sat, 12 Nov 2016 08:25:12 -0000

2016-11-11 12:23 GMT+01:00 Greg Huber <gregh3269@gmail.com>:
>> <s:text name=3D"<script>alert('ok')</script>" />
>
> ....this pops!

In the latest build? Because is see something like this in source page

Test: &lt;script&gt;alert(\'ok\')&lt;\/script&gt;

>> Maybe we should've thought about renaming this tag
>
>
> Think we are OK here as it does say what it does, maybe could add more in=
fo
> in the hover if we are going to change it.  Currently is says "Render a
> I18n text message"
>
> ##
>
> <s:text name=3D"script.test"/>
> script.test=3D<script type=3D"text/javascript">alert("ok");</script>

I assume you meant that "script.test=3D<script
type=3D"text/javascript">alert("ok");</script>" is passed a request
parameter? So again are using the latest build because I cannot
confirm this.

> ..but do have html in the ApplicationResources.properties file so sometim=
es
> I want it rendered as html eg <em>Important</em> but any <script></script=
>
> could be a escaped when its loaded from the file initially?  Its difficul=
t
> to say how far to take this!

To be clear, this won't affect your messages from .properties files,
so if you are using html in there you will get that html on your page,
it won't be escaped. Right now, after disabling searching default
message in ValueStack, even escaping is not needed.

> Think reducing the scope of <s:text> is worth doing, its easy to convert =
to
> <s:property> and also reduces the duplication / maintenance also.

Yes, but both these tags have different use cases, so I would leave
them just improve.


Regards
--=20
=C5=81ukasz
+ 48 606 323 122 http://www.lenart.org.pl/

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org