You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@beehive.apache.org by "Krista Baker (JIRA)" <be...@incubator.apache.org> on 2005/02/14 23:58:12 UTC
[jira] Created: (BEEHIVE-299) netui:anchor Event Attribute syntax can cause java script error
netui:anchor Event Attribute syntax can cause java script error
---------------------------------------------------------------
Key: BEEHIVE-299
URL: http://issues.apache.org/jira/browse/BEEHIVE-299
Project: Beehive
Type: Bug
Components: NetUI
Versions: V1
Reporter: Krista Baker
Priority: Minor
Repro:
Using the following jsp note the tag error on the first <netui:anchor> in the Browser window.
<%@ page language="java" contentType="text/html;charset=UTF-8"%>
<%@ taglib prefix="netui" uri="http://beehive.apache.org/netui/tags-html-1.0"%>
<%@ taglib prefix="netui-data" uri="http://beehive.apache.org/netui/tags-databinding-1.0"%>
<%@ taglib prefix="netui-template" uri="http://beehive.apache.org/netui/tags-template-1.0"%>
<netui:html>
<head>
<netui:base/>
</head>
<netui:body>
Causes Script error <br />
<netui:anchor onMouseDown="alert('OnMOUSEDOWN')" href="index.jsp">Script Error For onmousedown when formatted this way.</netui:anchor>
<br />
The following generate valid javascript:
<br />
<netui:anchor onMouseDown='alert("onmousedown")' href="index.jsp>No script error when double quotes switched with single quotes</netui:anchor>
<a href="index.jsp" onmousedown="alert('onmousedown')">No script error when html anchor tag is used with the same formatting as netui:anchor which returns a script error</a>
<a href="index.jsp" onmousedown='alert("onmousedown")'>No script error</a>
</netui:body>
</netui:html>
Config:
Mozilla 1.4 and Firefox 1.0 only display the script error when the anchor is clicked and the javascript executed. Internet Explorer recognizes the error when the page is opened.
Workaround - Use one of the other three possible tag configs to perform event attributes on the anchor tag.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
[jira] Resolved: (BEEHIVE-299) netui:anchor Event Attribute syntax can cause java script error
Posted by "Daryl Olander (JIRA)" <be...@incubator.apache.org>.
[ http://issues.apache.org/jira/browse/BEEHIVE-299?page=history ]
Daryl Olander resolved BEEHIVE-299:
-----------------------------------
Assign To: Alejandro Ramirez (was: Daryl Olander)
Resolution: Fixed
I've removed the special case logic. No all of the HTML tags should be using the double quote for output of JavaScript. I also removed the special case handling of onclick in the AnchorTag.Renderer. There was a todo to remove this and it is now gone.
The affected generated javascript includes:
FormSubmit from an Anchor
Popup Support with an Anchor
Client action on the anchor (coreWeb/Templates/DivTreePanel)
I tested all of these and they seem to work. I update the test results based upon the change to using double quote.
Revision: 154717
> netui:anchor Event Attribute syntax can cause java script error
> ---------------------------------------------------------------
>
> Key: BEEHIVE-299
> URL: http://issues.apache.org/jira/browse/BEEHIVE-299
> Project: Beehive
> Type: Bug
> Components: NetUI
> Versions: V1
> Reporter: Krista Baker
> Assignee: Alejandro Ramirez
> Priority: Minor
>
> Repro:
> Using the following jsp note the tag error on the first <netui:anchor> in the Browser window.
> <%@ page language="java" contentType="text/html;charset=UTF-8"%>
> <%@ taglib prefix="netui" uri="http://beehive.apache.org/netui/tags-html-1.0"%>
> <%@ taglib prefix="netui-data" uri="http://beehive.apache.org/netui/tags-databinding-1.0"%>
> <%@ taglib prefix="netui-template" uri="http://beehive.apache.org/netui/tags-template-1.0"%>
> <netui:html>
> <head>
> <netui:base/>
> </head>
> <netui:body>
> Causes Script error <br />
> <netui:anchor onMouseDown="alert('OnMOUSEDOWN')" href="index.jsp">Script Error For onmousedown when formatted this way.</netui:anchor>
> <br />
> The following generate valid javascript:
> <br />
> <netui:anchor onMouseDown='alert("onmousedown")' href="index.jsp>No script error when double quotes switched with single quotes</netui:anchor>
> <a href="index.jsp" onmousedown="alert('onmousedown')">No script error when html anchor tag is used with the same formatting as netui:anchor which returns a script error</a>
> <a href="index.jsp" onmousedown='alert("onmousedown")'>No script error</a>
> </netui:body>
> </netui:html>
> Config:
> Mozilla 1.4 and Firefox 1.0 only display the script error when the anchor is clicked and the javascript executed. Internet Explorer recognizes the error when the page is opened.
> Workaround - Use one of the other three possible tag configs to perform event attributes on the anchor tag.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
[jira] Reopened: (BEEHIVE-299) netui:anchor Event Attribute syntax can cause java script error
Posted by "Alejandro Ramirez (JIRA)" <be...@incubator.apache.org>.
[ http://issues.apache.org/jira/browse/BEEHIVE-299?page=history ]
Alejandro Ramirez reopened BEEHIVE-299:
---------------------------------------
Assign To: Daryl Olander (was: Alejandro Ramirez)
Re-openeing based on Daryl's comment:
-------------
Go ahead and reopen this. I was wrong about what I thought was happening. Now all I have to do is figure out why we special case onClick on the anchor (and area) tags.
----
> netui:anchor Event Attribute syntax can cause java script error
> ---------------------------------------------------------------
>
> Key: BEEHIVE-299
> URL: http://issues.apache.org/jira/browse/BEEHIVE-299
> Project: Beehive
> Type: Bug
> Components: NetUI
> Versions: V1
> Reporter: Krista Baker
> Assignee: Daryl Olander
> Priority: Minor
>
> Repro:
> Using the following jsp note the tag error on the first <netui:anchor> in the Browser window.
> <%@ page language="java" contentType="text/html;charset=UTF-8"%>
> <%@ taglib prefix="netui" uri="http://beehive.apache.org/netui/tags-html-1.0"%>
> <%@ taglib prefix="netui-data" uri="http://beehive.apache.org/netui/tags-databinding-1.0"%>
> <%@ taglib prefix="netui-template" uri="http://beehive.apache.org/netui/tags-template-1.0"%>
> <netui:html>
> <head>
> <netui:base/>
> </head>
> <netui:body>
> Causes Script error <br />
> <netui:anchor onMouseDown="alert('OnMOUSEDOWN')" href="index.jsp">Script Error For onmousedown when formatted this way.</netui:anchor>
> <br />
> The following generate valid javascript:
> <br />
> <netui:anchor onMouseDown='alert("onmousedown")' href="index.jsp>No script error when double quotes switched with single quotes</netui:anchor>
> <a href="index.jsp" onmousedown="alert('onmousedown')">No script error when html anchor tag is used with the same formatting as netui:anchor which returns a script error</a>
> <a href="index.jsp" onmousedown='alert("onmousedown")'>No script error</a>
> </netui:body>
> </netui:html>
> Config:
> Mozilla 1.4 and Firefox 1.0 only display the script error when the anchor is clicked and the javascript executed. Internet Explorer recognizes the error when the page is opened.
> Workaround - Use one of the other three possible tag configs to perform event attributes on the anchor tag.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
[jira] Resolved: (BEEHIVE-299) netui:anchor Event Attribute syntax can cause java script error
Posted by "Daryl Olander (JIRA)" <be...@incubator.apache.org>.
[ http://issues.apache.org/jira/browse/BEEHIVE-299?page=history ]
Daryl Olander resolved BEEHIVE-299:
-----------------------------------
Assign To: Alejandro Ramirez (was: Daryl Olander)
Resolution: Won't Fix
This is the problem. We have no way to know what form of quotes you used in the JSP. This means you can do either of these <... attr="alert('this')"> or <... attr='alert("this")'> in the JSP and all the tag gets is one version of the string or the other.
We've decide that it's too expensive to escape the string for HTML/JavaScript so we've decide that the tags will write out the single quoted form of the attribute and allow authors to use the more common form of double quote in their inclosed script. Really the best we can do, without doing an expensive pass through each JavaScript event and escaping the quotes.
> netui:anchor Event Attribute syntax can cause java script error
> ---------------------------------------------------------------
>
> Key: BEEHIVE-299
> URL: http://issues.apache.org/jira/browse/BEEHIVE-299
> Project: Beehive
> Type: Bug
> Components: NetUI
> Versions: V1
> Reporter: Krista Baker
> Assignee: Alejandro Ramirez
> Priority: Minor
>
> Repro:
> Using the following jsp note the tag error on the first <netui:anchor> in the Browser window.
> <%@ page language="java" contentType="text/html;charset=UTF-8"%>
> <%@ taglib prefix="netui" uri="http://beehive.apache.org/netui/tags-html-1.0"%>
> <%@ taglib prefix="netui-data" uri="http://beehive.apache.org/netui/tags-databinding-1.0"%>
> <%@ taglib prefix="netui-template" uri="http://beehive.apache.org/netui/tags-template-1.0"%>
> <netui:html>
> <head>
> <netui:base/>
> </head>
> <netui:body>
> Causes Script error <br />
> <netui:anchor onMouseDown="alert('OnMOUSEDOWN')" href="index.jsp">Script Error For onmousedown when formatted this way.</netui:anchor>
> <br />
> The following generate valid javascript:
> <br />
> <netui:anchor onMouseDown='alert("onmousedown")' href="index.jsp>No script error when double quotes switched with single quotes</netui:anchor>
> <a href="index.jsp" onmousedown="alert('onmousedown')">No script error when html anchor tag is used with the same formatting as netui:anchor which returns a script error</a>
> <a href="index.jsp" onmousedown='alert("onmousedown")'>No script error</a>
> </netui:body>
> </netui:html>
> Config:
> Mozilla 1.4 and Firefox 1.0 only display the script error when the anchor is clicked and the javascript executed. Internet Explorer recognizes the error when the page is opened.
> Workaround - Use one of the other three possible tag configs to perform event attributes on the anchor tag.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
[jira] Assigned: (BEEHIVE-299) netui:anchor Event Attribute syntax can cause java script error
Posted by "Daryl Olander (JIRA)" <be...@incubator.apache.org>.
[ http://issues.apache.org/jira/browse/BEEHIVE-299?page=history ]
Daryl Olander reassigned BEEHIVE-299:
-------------------------------------
Assign To: Daryl Olander
> netui:anchor Event Attribute syntax can cause java script error
> ---------------------------------------------------------------
>
> Key: BEEHIVE-299
> URL: http://issues.apache.org/jira/browse/BEEHIVE-299
> Project: Beehive
> Type: Bug
> Components: NetUI
> Versions: V1
> Reporter: Krista Baker
> Assignee: Daryl Olander
> Priority: Minor
>
> Repro:
> Using the following jsp note the tag error on the first <netui:anchor> in the Browser window.
> <%@ page language="java" contentType="text/html;charset=UTF-8"%>
> <%@ taglib prefix="netui" uri="http://beehive.apache.org/netui/tags-html-1.0"%>
> <%@ taglib prefix="netui-data" uri="http://beehive.apache.org/netui/tags-databinding-1.0"%>
> <%@ taglib prefix="netui-template" uri="http://beehive.apache.org/netui/tags-template-1.0"%>
> <netui:html>
> <head>
> <netui:base/>
> </head>
> <netui:body>
> Causes Script error <br />
> <netui:anchor onMouseDown="alert('OnMOUSEDOWN')" href="index.jsp">Script Error For onmousedown when formatted this way.</netui:anchor>
> <br />
> The following generate valid javascript:
> <br />
> <netui:anchor onMouseDown='alert("onmousedown")' href="index.jsp>No script error when double quotes switched with single quotes</netui:anchor>
> <a href="index.jsp" onmousedown="alert('onmousedown')">No script error when html anchor tag is used with the same formatting as netui:anchor which returns a script error</a>
> <a href="index.jsp" onmousedown='alert("onmousedown")'>No script error</a>
> </netui:body>
> </netui:html>
> Config:
> Mozilla 1.4 and Firefox 1.0 only display the script error when the anchor is clicked and the javascript executed. Internet Explorer recognizes the error when the page is opened.
> Workaround - Use one of the other three possible tag configs to perform event attributes on the anchor tag.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
[jira] Closed: (BEEHIVE-299) netui:anchor Event Attribute syntax can cause java script error
Posted by "Krista Baker (JIRA)" <be...@incubator.apache.org>.
[ http://issues.apache.org/jira/browse/BEEHIVE-299?page=history ]
Krista Baker closed BEEHIVE-299:
--------------------------------
Verified that the <netui:anchor> and <netui:imageAnchor> tags now accept javaScript event attributes the same way as the other <netui:... tags with double quotes around the outside and single on the inside.
> netui:anchor Event Attribute syntax can cause java script error
> ---------------------------------------------------------------
>
> Key: BEEHIVE-299
> URL: http://issues.apache.org/jira/browse/BEEHIVE-299
> Project: Beehive
> Type: Bug
> Components: NetUI
> Versions: V1
> Reporter: Krista Baker
> Assignee: Krista Baker
> Priority: Minor
>
> Repro:
> Using the following jsp note the tag error on the first <netui:anchor> in the Browser window.
> <%@ page language="java" contentType="text/html;charset=UTF-8"%>
> <%@ taglib prefix="netui" uri="http://beehive.apache.org/netui/tags-html-1.0"%>
> <%@ taglib prefix="netui-data" uri="http://beehive.apache.org/netui/tags-databinding-1.0"%>
> <%@ taglib prefix="netui-template" uri="http://beehive.apache.org/netui/tags-template-1.0"%>
> <netui:html>
> <head>
> <netui:base/>
> </head>
> <netui:body>
> Causes Script error <br />
> <netui:anchor onMouseDown="alert('OnMOUSEDOWN')" href="index.jsp">Script Error For onmousedown when formatted this way.</netui:anchor>
> <br />
> The following generate valid javascript:
> <br />
> <netui:anchor onMouseDown='alert("onmousedown")' href="index.jsp>No script error when double quotes switched with single quotes</netui:anchor>
> <a href="index.jsp" onmousedown="alert('onmousedown')">No script error when html anchor tag is used with the same formatting as netui:anchor which returns a script error</a>
> <a href="index.jsp" onmousedown='alert("onmousedown")'>No script error</a>
> </netui:body>
> </netui:html>
> Config:
> Mozilla 1.4 and Firefox 1.0 only display the script error when the anchor is clicked and the javascript executed. Internet Explorer recognizes the error when the page is opened.
> Workaround - Use one of the other three possible tag configs to perform event attributes on the anchor tag.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
[jira] Assigned: (BEEHIVE-299) netui:anchor Event Attribute syntax can cause java script error
Posted by "Alejandro Ramirez (JIRA)" <be...@incubator.apache.org>.
[ http://issues.apache.org/jira/browse/BEEHIVE-299?page=history ]
Alejandro Ramirez reassigned BEEHIVE-299:
-----------------------------------------
Assign To: Krista Baker (was: Alejandro Ramirez)
Please Verify.
> netui:anchor Event Attribute syntax can cause java script error
> ---------------------------------------------------------------
>
> Key: BEEHIVE-299
> URL: http://issues.apache.org/jira/browse/BEEHIVE-299
> Project: Beehive
> Type: Bug
> Components: NetUI
> Versions: V1
> Reporter: Krista Baker
> Assignee: Krista Baker
> Priority: Minor
>
> Repro:
> Using the following jsp note the tag error on the first <netui:anchor> in the Browser window.
> <%@ page language="java" contentType="text/html;charset=UTF-8"%>
> <%@ taglib prefix="netui" uri="http://beehive.apache.org/netui/tags-html-1.0"%>
> <%@ taglib prefix="netui-data" uri="http://beehive.apache.org/netui/tags-databinding-1.0"%>
> <%@ taglib prefix="netui-template" uri="http://beehive.apache.org/netui/tags-template-1.0"%>
> <netui:html>
> <head>
> <netui:base/>
> </head>
> <netui:body>
> Causes Script error <br />
> <netui:anchor onMouseDown="alert('OnMOUSEDOWN')" href="index.jsp">Script Error For onmousedown when formatted this way.</netui:anchor>
> <br />
> The following generate valid javascript:
> <br />
> <netui:anchor onMouseDown='alert("onmousedown")' href="index.jsp>No script error when double quotes switched with single quotes</netui:anchor>
> <a href="index.jsp" onmousedown="alert('onmousedown')">No script error when html anchor tag is used with the same formatting as netui:anchor which returns a script error</a>
> <a href="index.jsp" onmousedown='alert("onmousedown")'>No script error</a>
> </netui:body>
> </netui:html>
> Config:
> Mozilla 1.4 and Firefox 1.0 only display the script error when the anchor is clicked and the javascript executed. Internet Explorer recognizes the error when the page is opened.
> Workaround - Use one of the other three possible tag configs to perform event attributes on the anchor tag.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira