fr-manvi commented on PR #1668:
URL: https://github.com/apache/wicket/pull/1668#issuecomment-6239315067
Added `onErrorEscapesUserInputEchoedThroughInputVariable`. It submits
`\';alert(1)//` as the editor value. A validator error resolves through a
message key whose text is `Invalid value: ${input}`, so the payload reaches
`window.status` the same way it would from an application's own bundle.
`setMessage` skips variable substitution, which is why the original case had to
hard-code the message.
With plain `escapeQuotes` the response contains `Invalid value:
\\';alert(1)//`. JS reads the `\\` as an escaped backslash, so the quote after
it ends the string and `alert(1)` runs. With `escapeQuotesAndBackslash` you get
`\\\'` and the quote stays inside the literal. I checked that the new test
fails against the old helper and passes with the fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
