Details
-
Type: Improvement
-
Status: Closed
-
Priority: Major
-
Resolution: Fixed
-
Affects Version/s: 2.0.2
-
Fix Version/s: 3.0
-
Component/s: ACE-Components
-
Labels:None
-
Environment:ACE
-
Assignee Priority:P1
Description
Alter how javascript parameters are created, from:
String params = "'" + clientId + "'," +
JSONBuilder.create().
beginMap().
entry("menu", clientId+"_buttonselect").
endMap().toString()
+ "," +
JSONBuilder.create().
beginMap().
entry("ariaEnabled", EnvUtils.isAriaEnabled(facesContext)).
endMap().toString();
String finalScript = "ice.component.menubutton.updateProperties(" + params + ");";
to something like:
String finalScript = JSONBuilder.create().
beginFunction("ice.component.menubutton.updateProperties").
entry(clientId).
beginMap().
entry("menu", clientId+"_buttonselect").
endMap().
comma().
beginMap().
entry("ariaEnabled", EnvUtils.isAriaEnabled(facesContext)).
endMap().
endFunction().semicolon().toString();
There will be less intermediary Object creation, the code will be cleaner, and any other parameters to the function will be properly escaped. Have to add the appropriate beginFunction(-) / endFunction(-) methods, and test the implementation on a component renderer.
String params = "'" + clientId + "'," +
JSONBuilder.create().
beginMap().
entry("menu", clientId+"_buttonselect").
endMap().toString()
+ "," +
JSONBuilder.create().
beginMap().
entry("ariaEnabled", EnvUtils.isAriaEnabled(facesContext)).
endMap().toString();
String finalScript = "ice.component.menubutton.updateProperties(" + params + ");";
to something like:
String finalScript = JSONBuilder.create().
beginFunction("ice.component.menubutton.updateProperties").
entry(clientId).
beginMap().
entry("menu", clientId+"_buttonselect").
endMap().
comma().
beginMap().
entry("ariaEnabled", EnvUtils.isAriaEnabled(facesContext)).
endMap().
endFunction().semicolon().toString();
There will be less intermediary Object creation, the code will be cleaner, and any other parameters to the function will be properly escaped. Have to add the appropriate beginFunction(-) / endFunction(-) methods, and test the implementation on a component renderer.
Issue Links
- blocks
-
ICE-6947 Improve new ACE component security with JSONBuilder
- Closed
Activity
Mark Collette
created issue -
Mark Collette
made changes -
Mark Collette
made changes -
Salesforce Case | [] | |
Fix Version/s | 2.1 [ 10241 ] | |
Description |
Alter how javascript parameters are created, from: String params = "'" + clientId + "'," + JSONBuilder.create(). beginMap(). entry("menu", clientId+"_buttonselect"). endMap().toString() + "," + JSONBuilder.create(). beginMap(). entry("ariaEnabled", EnvUtils.isAriaEnabled(facesContext)). endMap().toString(); String finalScript = "ice.component.menubutton.updateProperties(" + params + ");"; to something like: String finalScript = JSONBuilder.create(). beginFunction("ice.component.menubutton.updateProperties"). entry(clientId). beginMap(). entry("menu", clientId+"_buttonselect"). endMap(). comma(). beginMap(). entry("ariaEnabled", EnvUtils.isAriaEnabled(facesContext)). endMap(). endFunction().semicolon().toString(); There will be less intermediary Object creation, the code will be cleaner, and any other parameters to the function will be properly escaped. |
Alter how javascript parameters are created, from: String params = "'" + clientId + "'," + JSONBuilder.create(). beginMap(). entry("menu", clientId+"_buttonselect"). endMap().toString() + "," + JSONBuilder.create(). beginMap(). entry("ariaEnabled", EnvUtils.isAriaEnabled(facesContext)). endMap().toString(); String finalScript = "ice.component.menubutton.updateProperties(" + params + ");"; to something like: String finalScript = JSONBuilder.create(). beginFunction("ice.component.menubutton.updateProperties"). entry(clientId). beginMap(). entry("menu", clientId+"_buttonselect"). endMap(). comma(). beginMap(). entry("ariaEnabled", EnvUtils.isAriaEnabled(facesContext)). endMap(). endFunction().semicolon().toString(); There will be less intermediary Object creation, the code will be cleaner, and any other parameters to the function will be properly escaped. Have to add the appropriate beginFunction(-) / endFunction(-) methods, and test the implementation on a component renderer. |
Assignee | Mark Collette [ mark.collette ] |
Ken Fyten
made changes -
Salesforce Case | [] | |
Assignee Priority | P1 |
Ken Fyten
made changes -
Salesforce Case | [] | |
Assignee Priority | P1 | P2 |
Ken Fyten
made changes -
Salesforce Case | [] | |
Fix Version/s | 2.1.1 [ 10282 ] | |
Fix Version/s | 2.1 [ 10241 ] | |
Assignee Priority | P2 |
Ken Fyten
made changes -
Salesforce Case | [] | |
Fix Version/s | 3.1 [ 10312 ] | |
Fix Version/s | 3.0.1 [ 10282 ] |
Ken Fyten
made changes -
Fix Version/s | 3.2 [ 10338 ] | |
Fix Version/s | 3.1 [ 10312 ] |
Ken Fyten
made changes -
Salesforce Case | [] |
Migration
made changes -
Fix Version/s | 3.3 [ 10370 ] | |
Fix Version/s | 3.2 [ 10338 ] |
Ken Fyten
made changes -
Assignee Priority | P1 [ 10010 ] |
Mark Collette
made changes -
Status | Open [ 1 ] | Resolved [ 5 ] |
Fix Version/s | 3.0 [ 10241 ] | |
Fix Version/s | 3.3 [ 10370 ] | |
Resolution | Fixed [ 1 ] |
Ken Fyten
made changes -
Status | Resolved [ 5 ] | Closed [ 6 ] |
Augmented JSONBuilder by adding:
Updated CheckboxButton to use the new technique, as an example of the new API.
So for the example in the jira description, this is how that would now look:
String finalScript = JSONBuilder.create().
beginFunction("ice.component.menubutton.updateProperties").
item(clientId).
beginMap().
entry("menu", clientId+"_buttonselect").
endMap().
beginMap().
entry("ariaEnabled", EnvUtils.isAriaEnabled(facesContext)).
endMap().
endFunction().toString();
scratchpad
Subversion 24938