You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@roller.apache.org by sn...@apache.org on 2026/09/07 17:01:02 UTC
(roller) 01/01: Use double-quoted href attributes on the comment management page
This is an automated email from the ASF dual-hosted git repository.
snoopdave pushed a commit to branch comment-author-url-quoting
in repository https://gitbox.apache.org/repos/asf/roller.git
commit 2e2357265b119a43799239a0e889c7e4aa8d0ddc
Author: David M. Johnson <sn...@apache.org>
AuthorDate: Mon Sep 7 13:00:42 2026 -0400
Use double-quoted href attributes on the comment management page
The comment management screen wrapped its <s:property/> URL values in
single-quoted href attributes. This switches them to double-quoted
attributes, matching the convention already used for URL-valued
attributes elsewhere in the authoring UI (for example the bookmark URL
in Bookmarks.jsp), so externally supplied URL values stay contained
within the attribute.
Adds a rule to AuthoringUiSinkAuditTest asserting the comment author URL
renders inside a double-quoted href.
Claude-Session: https://claude.ai/code/session_015X69HHQ5XnjRkJP8ymzwFf
---
.../main/webapp/WEB-INF/jsps/editor/Comments.jsp | 12 +++++------
.../struts2/editor/AuthoringUiSinkAuditTest.java | 24 ++++++++++++++++++++++
2 files changed, 30 insertions(+), 6 deletions(-)
diff --git a/app/src/main/webapp/WEB-INF/jsps/editor/Comments.jsp b/app/src/main/webapp/WEB-INF/jsps/editor/Comments.jsp
index 4a9877706..8331c284a 100644
--- a/app/src/main/webapp/WEB-INF/jsps/editor/Comments.jsp
+++ b/app/src/main/webapp/WEB-INF/jsps/editor/Comments.jsp
@@ -112,13 +112,13 @@
<ul class="pager">
<s:if test="pager.prevLink != null">
<li class="previous">
- <a href='<s:property value="pager.prevLink" />'>
+ <a href="<s:property value="pager.prevLink" />">
<span aria-hidden="true">←</span>Newer</a>
</li>
</s:if>
<s:if test="pager.nextLink != null">
<li class="next">
- <a href='<s:property value="pager.nextLink"/>'>Older
+ <a href="<s:property value="pager.nextLink"/>">Older
<span aria-hidden="true">→</span></a>
</li>
</s:if>
@@ -246,7 +246,7 @@
<div class="details">
<s:text name="commentManagement.entryTitled"/> :
- <a href='<s:property value="#comment.weblogEntry.permalink" />'>
+ <a href="<s:property value="#comment.weblogEntry.permalink" />">
<s:property value="#comment.weblogEntry.title"/></a>
</div>
@@ -277,7 +277,7 @@
<s:if test="#safeCommentUrl != null">
<div class="details">
<s:text name="commentManagement.commentByURL"/> :
- <a href='<s:property value="#safeCommentUrl" escapeHtml="true" />'>
+ <a href="<s:property value="#safeCommentUrl" escapeHtml="true" />">
<str:truncateNicely upper="60" appendToEnd="..."><s:property
value="#safeCommentUrl" escapeHtml="true"/></str:truncateNicely></a>
</div>
@@ -356,13 +356,13 @@
<ul class="pager">
<s:if test="pager.prevLink != null">
<li class="previous">
- <a href='<s:property value="pager.prevLink" />'>
+ <a href="<s:property value="pager.prevLink" />">
<span aria-hidden="true">←</span>Newer</a>
</li>
</s:if>
<s:if test="pager.nextLink != null">
<li class="next">
- <a href='<s:property value="pager.nextLink"/>'>Older
+ <a href="<s:property value="pager.nextLink"/>">Older
<span aria-hidden="true">→</span></a>
</li>
</s:if>
diff --git a/app/src/test/java/org/apache/roller/weblogger/ui/struts2/editor/AuthoringUiSinkAuditTest.java b/app/src/test/java/org/apache/roller/weblogger/ui/struts2/editor/AuthoringUiSinkAuditTest.java
index cf8eac734..d94dc72c1 100644
--- a/app/src/test/java/org/apache/roller/weblogger/ui/struts2/editor/AuthoringUiSinkAuditTest.java
+++ b/app/src/test/java/org/apache/roller/weblogger/ui/struts2/editor/AuthoringUiSinkAuditTest.java
@@ -70,6 +70,15 @@ public class AuthoringUiSinkAuditTest {
private static final Pattern HTML_WRITE =
Pattern.compile("\\.html\\(\\s*(?!\\)|''|\"\"|'<s:text|\"<s:text|\"<textarea|cdata\\.content|comments\\[id\\])[^)]");
+ /**
+ * A comment author URL rendered inside a single-quoted href attribute. This
+ * value is externally supplied and normalized rather than encoded for a
+ * quoted attribute, so it may contain an apostrophe; a single-quoted
+ * attribute would not reliably contain it.
+ */
+ private static final Pattern COMMENT_URL_SINGLE_QUOTED_HREF =
+ Pattern.compile("href\\s*=\\s*'\\s*<s:property\\s+value=\"#(safeCommentUrl|comment\\.url)\"");
+
/**
* The comment moderation screen has a separate round-trip for its already
* encoded editing markup; this audit focuses on authoring values inserted
@@ -139,6 +148,21 @@ public class AuthoringUiSinkAuditTest {
+ offenders.size() + ":\n " + String.join("\n ", offenders));
}
+ /**
+ * The comment author URL travels into an href attribute on the comment
+ * management screen. That attribute must be double-quoted, consistent with
+ * how other externally-supplied URL values (for example the bookmark URL)
+ * are already written on the authoring screens.
+ */
+ @Test
+ public void commentAuthorUrlUsesDoubleQuotedHref() throws IOException {
+ List<String> offenders = findMatches(COMMENT_URL_SINGLE_QUOTED_HREF);
+ assertTrue(offenders.isEmpty(),
+ "comment author URLs must render inside a double-quoted href "
+ + "attribute; found " + offenders.size() + ":\n "
+ + String.join("\n ", offenders));
+ }
+
/**
* Guards the audit itself: if the JSP directory moved or the patterns stopped
* matching anything at all, the three tests above would pass vacuously.