You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@wicket.apache.org by "ASF subversion and git services (JIRA)" <ji...@apache.org> on 2018/05/26 06:46:00 UTC
[jira] [Commented] (WICKET-6553) SelectOptions doesn't html-encode
option values
[ https://issues.apache.org/jira/browse/WICKET-6553?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16491541#comment-16491541 ]
ASF subversion and git services commented on WICKET-6553:
---------------------------------------------------------
Commit c2bf22c1f98029dcdb5287466061dc9e74c65f89 in wicket's branch refs/heads/wicket-6.x from [~svenmeier]
[ https://git-wip-us.apache.org/repos/asf?p=wicket.git;h=c2bf22c ]
WICKET-6553 SelectionOptions escape markup
> SelectOptions doesn't html-encode option values
> -----------------------------------------------
>
> Key: WICKET-6553
> URL: https://issues.apache.org/jira/browse/WICKET-6553
> Project: Wicket
> Issue Type: Bug
> Components: wicket-extensions
> Reporter: Jyri-Matti Lähteenmäki
> Assignee: Sven Meier
> Priority: Major
> Attachments: myproject.zip
>
>
> This will show a javascript alert dialog (jetty:run the attached example app):
> {code:java}
> add(new Select<String>("select")
> .add(new SelectOptions<String>("selectOptions", Arrays.asList("<script>alert('hello');</script>"), new IOptionRenderer<String>() {
> @Override
> public String getDisplayValue(String arg0) {
> return arg0;
> }
> @Override
> public IModel<String> getModel(String arg0) {
> return Model.of(arg0);
> }
> })));{code}
>
> If I understand correctly, IOptionRenderer is for the user to provide the human-readable representation of the object (in this example just a String), and shouldn't be responsible for any kind of html encoding.
> Should org.apache.wicket.extensions.markup.html.form.select.SelectOptions.SimpleSelectOption do the encoding?
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)