ICEfaces
  1. ICEfaces
  2. ICE-2647

Option to not escape single quotes in most components

    Details

    • Type: Improvement Improvement
    • Status: Closed
    • Priority: Minor Minor
    • Resolution: Invalid
    • Affects Version/s: 1.7
    • Fix Version/s: None
    • Component/s: ICE-Components
    • Labels:
      None
    • Environment:
      Any

      Description

      The current behavior of components such as outputLink, commandButton, etc. is to render single quotes used in any attribute as ' and double quotes as " To prevent cross site scripting, only outputText has an escape attribute.
      This improvement request is to add a lesser escape attribute to commandButton, commandLink, outputLink, etc.
      Basically this "soft escape" attribute would (if set to false) not escape single and double quotes. An example use case where this is needed is:

      <ice:outputLink value="http://www.google.com" onclick="javascript: doSomething('important', '40');">......

      In this case the onclick will render with &#39; for the single quotes, which will not work properly with the javascript method being called. If a softescape="false" (or similar) attribute was allowed, this situation could be solved.

      Note that the XML attribute syntax allows the following:

      AttValue ::= '"' ([^<&"] | Reference)* '"' | "'" ([^<&'] | Reference)* "'"

      So a softescape attribute would only need to ignore the escaping of a few characters, while still maintaining security against cross site scripting.

        Activity

        There are no subversion log entries for this issue yet.

          People

          • Assignee:
            Unassigned
            Reporter:
            Carlo Guglielmin
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: