[jira] Updated: (STR-1850) ResponseFilter does not handle UTF-8 encoded characters with &#

["Dinesh Garnayak (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/struts/browse/STR-1850?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Dinesh Garnayak updated STR-1850:
---------------------------------

    Description: 
If I have a UTF-8 encoded character like "堂" (å ‚, a building in
Traditional Chinese) and use this value in an html tag (e.g. html:text), the '&'
is encoded to "&", which produces output that looks like "堂" 

The filter method should "look ahead" when it goes into the '&' case and if the
following char is '#', it should not modify the '&' char. 

The filter method from ResponseUtils with a suggested change:

        for (int i = 0; i < content.length; i++) {
            switch (content[i]) {
            case '<':
                result.append("&lt;");
                break;
            case '>':
                result.append("&gt;");
                break;
            case '&':
--->	        if (content[i + 1] != '#')
--->		  result.append("&amp;");
--->		else
                  result.append("&");
                break;
            case '"':
                result.append("&quot;");
                break;
            case '\'':
                result.append("&#39;");
                break;
            default:
                result.append(content[i]);
            }
        }

This probably needs a minor adjustment, as this doesn't handle the case where
the '&' char is the last character in the String (bounds check)

  was:
If I have a UTF-8 encoded character like "&#22530;" (堂, a building in
Traditional Chinese) and use this value in an html tag (e.g. html:text), the '&'
is encoded to "&amp;", which produces output that looks like "&amp;#22530;" 

The filter method should "look ahead" when it goes into the '&' case and if the
following char is '#', it should not modify the '&' char. 

The filter method from ResponseUtils with a suggested change:

        for (int i = 0; i < content.length; i++) {
            switch (content[i]) {
            case '<':
                result.append("&lt;");
                break;
            case '>':
                result.append("&gt;");
                break;
            case '&':
--->	        if (content[i + 1] != '#')
--->		  result.append("&amp;");
--->		else
                  result.append("&");
                break;
            case '"':
                result.append("&quot;");
                break;
            case '\'':
                result.append("&#39;");
                break;
            default:
                result.append(content[i]);
            }
        }

This probably needs a minor adjustment, as this doesn't handle the case where
the '&' char is the last character in the String (bounds check)


Hi,

This issue is marked as fix. Please tell me which version of struts jar has this fix and where i can get that jar

> ResponseFilter does not handle UTF-8 encoded characters with &#
> ---------------------------------------------------------------
>
>                 Key: STR-1850
>                 URL: https://issues.apache.org/struts/browse/STR-1850
>             Project: Struts 1
>          Issue Type: Bug
>          Components: Core
>    Affects Versions: 1.1.0
>         Environment: Operating System: All
> Platform: All
>            Reporter: Dave Hodson
>            Assignee: David Evans
>
> If I have a UTF-8 encoded character like "&#22530;" (å ‚, a building in
> Traditional Chinese) and use this value in an html tag (e.g. html:text), the '&'
> is encoded to "&amp;", which produces output that looks like "&amp;#22530;" 
> The filter method should "look ahead" when it goes into the '&' case and if the
> following char is '#', it should not modify the '&' char. 
> The filter method from ResponseUtils with a suggested change:
>         for (int i = 0; i < content.length; i++) {
>             switch (content[i]) {
>             case '<':
>                 result.append("&lt;");
>                 break;
>             case '>':
>                 result.append("&gt;");
>                 break;
>             case '&':
> --->	        if (content[i + 1] != '#')
> --->		  result.append("&amp;");
> --->		else
>                   result.append("&");
>                 break;
>             case '"':
>                 result.append("&quot;");
>                 break;
>             case '\'':
>                 result.append("&#39;");
>                 break;
>             default:
>                 result.append(content[i]);
>             }
>         }
> This probably needs a minor adjustment, as this doesn't handle the case where
> the '&' char is the last character in the String (bounds check)

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.