[struts] branch WW-5022-escape-false updated: WW-5022 Documents that setting escapeHtmlBody per tag takes precedence over global flag

[lu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lukaszlenart pushed a commit to branch WW-5022-escape-false
in repository https://gitbox.apache.org/repos/asf/struts.git


The following commit(s) were added to refs/heads/WW-5022-escape-false by this push:
     new 7a69652  WW-5022 Documents that setting escapeHtmlBody per tag takes precedence over global flag
7a69652 is described below

commit 7a696523f02dcf118003a708f4d8b3fcd9d48436
Author: Lukasz Lenart <lu...@apache.org>
AuthorDate: Tue Jan 4 19:49:01 2022 +0100

    WW-5022 Documents that setting escapeHtmlBody per tag takes precedence over global flag
---
 .../org/apache/struts2/default.properties          |  7 ++++++-
 .../apache/struts2/views/jsp/ui/AnchorTest.java    | 23 ++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/core/src/main/resources/org/apache/struts2/default.properties b/core/src/main/resources/org/apache/struts2/default.properties
index df40694..571dcf5 100644
--- a/core/src/main/resources/org/apache/struts2/default.properties
+++ b/core/src/main/resources/org/apache/struts2/default.properties
@@ -151,6 +151,11 @@ struts.ui.theme.expansion.token=~~~
 ### Sets the default template type. Either ftl, vm, or jsp
 struts.ui.templateSuffix=ftl
 
+### Sets a global flag which will escape html body of Anchor, Submit and Component tag
+### You can control this flag per tag, e.g.: <s:a ... escapeHtmlTag="true">...</s:a>
+### and this take precedence over the global flag
+# struts.ui.escapeHtmlBody=true
+
 ### Configuration reloading
 ### This will cause the configuration to reload struts.xml when it is changed
 # struts.configuration.xml.reload=false
@@ -230,7 +235,7 @@ struts.handle.exception=true
 
 ### Applies maximum length allowed on OGNL expressions for security enhancement (optional)
 ###
-### **WARNING**: If developers enable this option (by configuration) they should make sure that they understand the implications of setting 
+### **WARNING**: If developers enable this option (by configuration) they should make sure that they understand the implications of setting
 ###   struts.ognl.expressionMaxLength.  They must choose a value large enough to permit ALL valid OGNL expressions used within the application.
 ###   Values larger than the 200-400 range have diminishing security value (at which point it is really only a "style guard" for long OGNL
 ###   expressions in an application.  Setting a value of null or "" will also disable the feature.
diff --git a/core/src/test/java/org/apache/struts2/views/jsp/ui/AnchorTest.java b/core/src/test/java/org/apache/struts2/views/jsp/ui/AnchorTest.java
index 53fa8ba..7c3f80d 100644
--- a/core/src/test/java/org/apache/struts2/views/jsp/ui/AnchorTest.java
+++ b/core/src/test/java/org/apache/struts2/views/jsp/ui/AnchorTest.java
@@ -298,4 +298,27 @@ public class AnchorTest extends AbstractUITagTest {
         tag.doEndTag();
     }
 
+    public void testTagAttributeTakesPrecedenceOverInjectEscapeHtmlBodyFlag() throws Exception {
+        // given
+        initDispatcherWithConfigs("struts-default.xml, struts-escape-body.xml");
+        String escapeHtmlBody = container.getInstance(String.class, StrutsConstants.STRUTS_UI_ESCAPE_HTML_BODY);
+        assertEquals("true", escapeHtmlBody);
+
+        createMocks();
+
+        createAction();
+
+        AnchorTag tag = createTag();
+        tag.setEscapeHtmlBody("false");
+
+        // when
+        tag.doStartTag();
+
+        // then
+        Anchor component = (Anchor) tag.getComponent();
+        assertFalse(component.escapeHtmlBody());
+
+        tag.doEndTag();
+    }
+
 }