[jira] [Commented] (GROOVY-12277) improve groovydoc encoding edge cases

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/GROOVY-12277?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105565#comment-18105565 ] 

ASF GitHub Bot commented on GROOVY-12277:
-----------------------------------------

paulk-asert opened a new pull request, #2814:
URL: https://github.com/apache/groovy/pull/2814

   Two places where groovydoc builds HTML around text taken from the source it is documenting, without encoding it for the context it lands in.
   
   A {@link} or @see reference is split into a target and a label, both of which are then concatenated into an anchor the tool constructs: the target into href, the label into the element text, and for a resolved class the short name into title as well. None was encoded, so a reference could close the attribute and open a tag of its own. Encode each for its context, the attributes through encodeAttribute and the text through encodeAngleBrackets.
   
   An annotation's name and description are emitted into the class declaration and every member heading. description() carries the annotation's arguments as they were written, so an annotation holding a string literal put that literal into the page verbatim. Encode both, leaving the linkable() call alone since that one does produce markup.
   
   This is groovydoc's own construction rather than the raw HTML a doc comment body may contain by javadoc parity, so the passthrough that covers a comment body does not extend to it. For the annotation case the text is not from a comment at all: it is source code, and reaches the page without any doc comment being written.
   
   Not changed: the @default tag GroovydocJavaVisitor appends for an annotation member's default value. It is added to the raw comment text and no template renders it as a declaration, and constantValueExpression() is only tested for nullity, so that value does not reach a declaration block.




> improve groovydoc encoding edge cases
> -------------------------------------
>
>                 Key: GROOVY-12277
>                 URL: https://issues.apache.org/jira/browse/GROOVY-12277
>             Project: Groovy
>          Issue Type: Improvement
>            Reporter: Paul King
>            Assignee: Paul King
>            Priority: Major
>




--
This message was sent by Atlassian Jira
(v8.20.10#820010)