[
https://issues.apache.org/jira/browse/WICKET-6553?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16491541#comment-16491541
]
ASF subversion and git services commented on WICKET-6553:
---------------------------------------------------------
Commit c2bf22c1f98029dcdb5287466061dc9e74c65f89 in wicket's branch
refs/heads/wicket-6.x from [~svenmeier]
[ https://git-wip-us.apache.org/repos/asf?p=wicket.git;h=c2bf22c ]
WICKET-6553 SelectionOptions escape markup
> SelectOptions doesn't html-encode option values
> -----------------------------------------------
>
> Key: WICKET-6553
> URL: https://issues.apache.org/jira/browse/WICKET-6553
> Project: Wicket
> Issue Type: Bug
> Components: wicket-extensions
> Reporter: Jyri-Matti Lähteenmäki
> Assignee: Sven Meier
> Priority: Major
> Attachments: myproject.zip
>
>
> This will show a javascript alert dialog (jetty:run the attached example app):
> {code:java}
> add(new Select<String>("select")
> .add(new SelectOptions<String>("selectOptions",
> Arrays.asList("<script>alert('hello');</script>"), new
> IOptionRenderer<String>() {
> @Override
> public String getDisplayValue(String arg0) {
> return arg0;
> }
> @Override
> public IModel<String> getModel(String arg0) {
> return Model.of(arg0);
> }
> })));{code}
>
> If I understand correctly, IOptionRenderer is for the user to provide the
> human-readable representation of the object (in this example just a String),
> and shouldn't be responsible for any kind of html encoding.
> Should
> org.apache.wicket.extensions.markup.html.form.select.SelectOptions.SimpleSelectOption
> do the encoding?
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
