ICEfaces
  1. ICEfaces
  2. ICE-8806

ice:outputLabel - Add an escape attribute

    Details

    • Type: Improvement Improvement
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: EE-1.8.2.GA_P04
    • Fix Version/s: EE-1.8.2.GA_P06
    • Component/s: ICE-Components
    • Labels:
      None
    • Environment:
      All
    • Salesforce Case Reference:

      Description

      With the changes made to resolve XSS attacks in ICE-5854, the ice:outputLabel no longer escapes the value. The feature request is to add in an escape attribute which will allow the developer to decide if it should be escaped or not. This would be similar functionality as the ice:outputText.

        Issue Links

          Activity

          Arran Mccullough created issue -
          Hide
          Arran Mccullough added a comment -

          A test case that shows this behavior can be provided.

          Show
          Arran Mccullough added a comment - A test case that shows this behavior can be provided.
          Arran Mccullough made changes -
          Field Original Value New Value
          Salesforce Case Reference 5007000000PYbXoAAL
          Ken Fyten made changes -
          Fix Version/s EE-1.8.2.GA_P06 [ 10470 ]
          Arran Mccullough made changes -
          Link This issue depends on ICE-8850 [ ICE-8850 ]
          Ken Fyten made changes -
          Assignee yip.ng [ yip.ng ]
          yip.ng made changes -
          Attachment screenshot-01.png [ 15308 ]
          Hide
          yip.ng added a comment - - edited

          Two problems:

          1. Even with <ice:outputText>, the use of the "<" and "&" characters will generate SAXParseException. You must use the entities "&lt;" and "&amp;". (This rather defeats the usefulness of the escape attribute?) The ">" character is OK.

          SEVERE: Parse Fatal Error at line 711 column 41: The value of attribute "value" associated with an element type "null" must not contain the '<' character.
          org.xml.sax.SAXParseException: The value of attribute "value" associated with an element type "null" must not contain the '<' character.

          SEVERE: Parse Fatal Error at line 711 column 42: The entity name must immediately follow the '&' in the entity reference.
          org.xml.sax.SAXParseException: The entity name must immediately follow the '&' in the entity reference.

          2. Using the exact same method DOMUtils.escapeAnsi() to do the escape as in <ice:outputText>, with exactly the same escaped output string in the renderer, the characters will still show up as entities on the web page. See screenshot-01.png. Maybe the the browser just doesn't translate the entities in a label tag?

          Show
          yip.ng added a comment - - edited Two problems: 1. Even with <ice:outputText>, the use of the "<" and "&" characters will generate SAXParseException. You must use the entities "&lt;" and "&amp;". (This rather defeats the usefulness of the escape attribute?) The ">" character is OK. SEVERE: Parse Fatal Error at line 711 column 41: The value of attribute "value" associated with an element type "null" must not contain the '<' character. org.xml.sax.SAXParseException: The value of attribute "value" associated with an element type "null" must not contain the '<' character. SEVERE: Parse Fatal Error at line 711 column 42: The entity name must immediately follow the '&' in the entity reference. org.xml.sax.SAXParseException: The entity name must immediately follow the '&' in the entity reference. 2. Using the exact same method DOMUtils.escapeAnsi() to do the escape as in <ice:outputText>, with exactly the same escaped output string in the renderer, the characters will still show up as entities on the web page. See screenshot-01.png. Maybe the the browser just doesn't translate the entities in a label tag?
          Repository Revision Date User Message
          ICEsoft Public SVN Repository #32946 Thu Jan 03 15:44:22 MST 2013 yip.ng ICE-8806: ice:outputLabel - Add an escape attribute.
          Files Changed
          Commit graph MODIFY /icefaces/trunk/icefaces/core/src/com/icesoft/faces/renderkit/dom_html_basic/LabelRenderer.java
          Commit graph MODIFY /icefaces/trunk/icefaces/component-metadata/src/main/resources/conf/ice_properties/ice-outputLabel-props.xml
          Hide
          yip.ng added a comment -

          More puzzling findings:

          1. Even with escape="false", <ice:outputText> still displays the characters properly. So what's the point of the escape?

          2. Created a minimal HTML page to display entities in <label> tag, and it works properly. So what's different in our rendering that causes it not to work?

          Show
          yip.ng added a comment - More puzzling findings: 1. Even with escape="false", <ice:outputText> still displays the characters properly. So what's the point of the escape? 2. Created a minimal HTML page to display entities in <label> tag, and it works properly. So what's different in our rendering that causes it not to work?
          Hide
          yip.ng added a comment - - edited

          Label value was already always escaped inside createTextNode(). So why does the JIRA description say "ice:outputLabel no longer escapes the value"? When I added escapeAnsi() in the renderer, it caused a double escape.

          Attribute added, and logic changed to avoid double escape.

          Confusions:

          When value is hardcoded, it goes through SAX parser, and the parser throws exceptions on certain characters. So user still has to escape themselves. In this case the parser will convert back to original characters before the renderer sees them.

          When value is in messages file, characters don't go through parser.

          Some characters will display properly whether you escape them or not.

          Revision: 32946


          Modified : /icefaces/trunk/icefaces/component-metadata/src/main/resources/conf/ice_properties/ice-outputLabel-props.xml
          Modified : /icefaces/trunk/icefaces/core/src/com/icesoft/faces/renderkit/dom_html_basic/LabelRenderer.java

          Show
          yip.ng added a comment - - edited Label value was already always escaped inside createTextNode(). So why does the JIRA description say "ice:outputLabel no longer escapes the value"? When I added escapeAnsi() in the renderer, it caused a double escape. Attribute added, and logic changed to avoid double escape. Confusions: When value is hardcoded, it goes through SAX parser, and the parser throws exceptions on certain characters. So user still has to escape themselves. In this case the parser will convert back to original characters before the renderer sees them. When value is in messages file, characters don't go through parser. Some characters will display properly whether you escape them or not. Revision: 32946 Modified : /icefaces/trunk/icefaces/component-metadata/src/main/resources/conf/ice_properties/ice-outputLabel-props.xml Modified : /icefaces/trunk/icefaces/core/src/com/icesoft/faces/renderkit/dom_html_basic/LabelRenderer.java
          yip.ng made changes -
          Status Open [ 1 ] Resolved [ 5 ]
          Resolution Fixed [ 1 ]
          Hide
          Cruz Miraback added a comment -

          Confirmed using ICEfaces 1.8.2.GA_P06 build 1 in Firefox19, Chrome24, IE6/7/9.

          Show
          Cruz Miraback added a comment - Confirmed using ICEfaces 1.8.2.GA_P06 build 1 in Firefox19, Chrome24, IE6/7/9.
          Ken Fyten made changes -
          Component/s Components [ 10012 ]
          Component/s ACE-Components [ 10050 ]
          Ken Fyten made changes -
          Status Resolved [ 5 ] Closed [ 6 ]

            People

            • Assignee:
              yip.ng
              Reporter:
              Arran Mccullough
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: