Mailing-List: contact issues-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@struts.apache.org
Date: Thu, 9 Nov 2017 17:19:00 +0000 (UTC)
From: "Hudson (JIRA)" <jira@apache.org>
To: issues@struts.apache.org
Message-ID: <JIRA.13115623.1509628858000.197962.1510247940535@Atlassian.JIRA>
In-Reply-To: <JIRA.13115623.1509628858000@Atlassian.JIRA>
References: <JIRA.13115623.1509628858000@Atlassian.JIRA> <JIRA.13115623.1509628858977@jira-lw-us.apache.org>
Subject: [jira] [Commented] (WW-4888) HTML escaping on the text tag
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Thu, 09 Nov 2017 17:19:10 -0000


    [ https://issues.apache.org/jira/browse/WW-4888?page=3Dcom.atlassian.ji=
ra.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D1624608=
7#comment-16246087 ]=20

Hudson commented on WW-4888:
----------------------------

SUCCESS: Integrated in Jenkins build Struts-master-JDK7 #54 (See [https://b=
uilds.apache.org/job/Struts-master-JDK7/54/])
WW-4888 add escaping options to text tag (stefaan.dutry: rev cde63169f0b871=
7fc29355509f5ac365a843993a)
* (edit) core/src/main/java/org/apache/struts2/views/jsp/TextTag.java
* (edit) core/src/test/java/org/apache/struts2/views/jsp/TextTagTest.java
* (edit) core/src/site/resources/tags/text.html
* (edit) core/src/main/java/org/apache/struts2/components/Text.java
* (edit) core/src/main/java/org/apache/struts2/views/jsp/PropertyTag.java
* (edit) core/src/test/resources/org/apache/struts2/TestAction.properties


> HTML escaping on the text tag
> -----------------------------
>
>                 Key: WW-4888
>                 URL: https://issues.apache.org/jira/browse/WW-4888
>             Project: Struts 2
>          Issue Type: Improvement
>          Components: Core Tags
>    Affects Versions: 2.5.13
>            Reporter: Pierre-Yves Soblet
>             Fix For: 2.5.14
>
>         Attachments: text-vs-property.png
>
>
> Assuming an i18n bundle with the following entry:
> {code}
> sample.message=3DThis is a dumb smiley <:=E2=80=91|
> {code}
> The following tag produces a value that is properly escaped for HTML:
> {code}
> <s:property value=3D"%{getText('sample.message')}"/>
> {code}
> However, the *text* tag does not escape the "<" character and cannot be s=
afely used in HTML:
> {code}
> <s:text name=3D"sample.message"/>
> {code}
> The text tag documentation (http://struts.apache.org/tag-developers/text-=
tag.html) neither states HTML escaping is performed nor warns it is not.
> In the FAQ, the "How to escape special chars in resource bundles" article=
 (https://struts.apache.org/docs/how-to-escape-special-chars-in-resource-bu=
ndles.html) describes how to escape special characters of the MessageFormat=
 syntax but does not mention HTML escaping.
> I assume HTML escaping on the text tag cannot be added now without breaki=
ng backward compatibility, but maybe an "escapeHtml" attribute could be add=
ed (as with the property tag)?=20


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)