mraible commented on code in PR #176:
URL: https://github.com/apache/roller/pull/176#discussion_r3891453222
##########
app/src/main/webapp/WEB-INF/jsps/editor/Comments.jsp:
##########
@@ -273,12 +273,12 @@
</s:else>
</div>
- <s:if test="#comment.url != null &&
!#comment.url.equals('')">
+ <s:if test="#comment.safeUrl != null">
Review Comment:
Hiding the URL entirely when it fails validation takes away the thing the
moderator needs to judge the comment (`javascript:...`, a homoglyph domain, an
intranet host). Render the raw value as escaped text when `safeUrl` is `null`
and only make it a link when it isn't.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
