[jira] [Created] (WICKET-6553) SelectOptions doesn't html-encode option values

["Jyri-Matti Lähteenmäki (JIRA)" <ji...@apache.org>]

Jyri-Matti Lähteenmäki created WICKET-6553:
----------------------------------------------

             Summary: SelectOptions doesn't html-encode option values
                 Key: WICKET-6553
                 URL: https://issues.apache.org/jira/browse/WICKET-6553
             Project: Wicket
          Issue Type: Bug
          Components: wicket-extensions
            Reporter: Jyri-Matti Lähteenmäki
         Attachments: myproject.zip

This will show a javascript alert dialog (jetty:run the attached example app):
{code:java}
add(new Select<String>("select")
        .add(new SelectOptions<String>("selectOptions", Arrays.asList("<script>alert('hello');</script>"), new IOptionRenderer<String>() {
                @Override
                public String getDisplayValue(String arg0) {
                    return arg0;
                }
                @Override
                public IModel<String> getModel(String arg0) {
                    return Model.of(arg0);
                }
            })));{code}
 

If I understand correctly, IOptionRenderer is for the user to provide the human-readable representation of the object (in this example just a String), and shouldn't be responsible for any kind of html encoding.

Should org.apache.wicket.extensions.markup.html.form.select.SelectOptions.SimpleSelectOption do the encoding?

 



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)