You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@struts.apache.org by "Rene Gielen (JIRA)" <ji...@apache.org> on 2008/02/25 07:13:09 UTC

[jira] Reopened: (WW-2427) s:a does not HTML-escape "href" attribute value

     [ https://issues.apache.org/struts/browse/WW-2427?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Rene Gielen reopened WW-2427:
-----------------------------

      Assignee: Rene Gielen  (was: Don Brown)

Reopened to apply fix to 2.0.x tree

> s:a does not HTML-escape "href" attribute value
> -----------------------------------------------
>
>                 Key: WW-2427
>                 URL: https://issues.apache.org/struts/browse/WW-2427
>             Project: Struts 2
>          Issue Type: Bug
>          Components: Plugin - Tags
>    Affects Versions: 2.0.11
>            Reporter: Antonio Petrelli
>            Assignee: Rene Gielen
>             Fix For: 2.1.1
>
>
> The <s:a> does not escape with HTML entities the "href" attribute value. This can lead to invalid HTML and, in certain cases, to 
> XSS attacks.
> Probably a new attribute, that specify if the escape is enabled or not, should be added.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.