Details
-
Type:
Bug
-
Status: Closed
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 1.7.1
-
Fix Version/s: 1.7.2
-
Component/s: ICE-Components
-
Labels:None
-
Environment:all
Description
<script type="text/javascript">
alert("Beep");
</script>
Currently gets rendered out as:
<script type="text/javascript">
<span id = "_components_buttonsAndLinks_WAR_componentshowcase_INSTANCE_2nr4_ :j_id4">alert("Beep");</span>
</script>
Wrapping the contents in a <span> causes the code to, obviously, not execute. The problem surfaces in the 1.7 branch on revision 17279.
The problem according to Mark is:
With JSF 1.1, generated ids are of the form _idNUMBER, whereas with JSF 1.2, they are j_id_NUMBER.
In TextRenderer, part of the logic to have a span is:
if (idNotNull(uiComponent) && !uiComponent.getId().startsWith("_")) {
return true;
}
Which means, if the component has an id, and it was specifically given, and not generated, than use a span. But the heuristic for it not being generated was for JSF 1.1, not JSF 1.2. It worked out, because we had put in place our own generated id scheme, for plain text, that was _iceIDNUMBER, which started with the underscore. Changing that to use the JSF 1.2 generated id broke things.
The solution is not to back out the generated id fix. Instead we could update TextRenderer to use a better heuristic for having a specified id. Or we could just set a flag on OutputText, so it will just not put spans around plain text. There's the little question of when <ice:outputText> is used (and not plain text), and no id was given, so it's generated, what we're supposed to do, use a span or not.
Issue Links
Activity
- All
- Comments
- History
- Activity
- Remote Attachments
- Subversion
Hi,
In the same way, title tag has the same problem.
Please see: http://jira.icefaces.org/browse/ICE-3370
regards,
Note from Deryk:
This has some serious consequences for apps that have inline <script> or <style> tags embedded in their existing pages. We don't tend to do this so a lot of our apps won't show any ill effects in testing but I think it could impact a lot of customers. It stops incline scripts from being executed and inline styles from being applied.
This is specific to JSPs.
Currently, the outputText renderer tries to determine if it should wrap it's contents in a SPAN tag using a cruddy fuzzy bit of logic. Instead, we should just add a new attribute to the ice:outputText to switch the SPAN wrapping on/off, called 'nospan', default is false. The JSP parser will then assign this attribute the correct value depending on whether the component is being used to render an HTML tag such as TITLE, SCRIPT, STYLE, etc. The correct value in this case, being 'nospan=true'.
See screenshot-1 for an illustration of the problem. Notice how the texts of the <title>, <style> and <script> tags are surrounded by <span> tags. And the style and script are not being executed.
Note that you can use either plain text or <ice:outputText> inside a <title> tag or <style> tag. This JIRA case is for when you use plain text.
A "nospan" attribute has already been added to the <ice:outputText> tag in ICE-1931. So to avoid a span tag in that case, just set "nospan" to true:
<title><ice:outputText value="ICEfaces Component Suite" nospan="true"/></title>
Tested successfully on Branch 1.7 revision #17583
(Test environment: Tomcat 6 + Firefox 2, IE 6, Opera 9.2)
Hi,
on the current svn, The content of <style> tags are being wrapped by <span> tags too.
regards,