[
https://issues.apache.org/jira/browse/SLING-11768?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17692004#comment-17692004
]
Radu Cotescu commented on SLING-11768:
--------------------------------------
[~kwin], this seems to be the commit that encoded the dash like we see it now:
https://github.com/apache/sling-org-apache-sling-xss/commit/bf2fb9bfb7aad00ece84456b3bd0a015d61788b9
I have to agree with the observations from the commit and the subsequent
comments from SLING-5946/SLING-8879. This issue is therefore not in the HTL
implementation, but in the XSS bundle.
> Display Context "scriptString" encodes hyphen (-) as \u002D
> -----------------------------------------------------------
>
> Key: SLING-11768
> URL: https://issues.apache.org/jira/browse/SLING-11768
> Project: Sling
> Issue Type: Bug
> Components: HTL, XSS Protection API
> Reporter: Konrad Windszus
> Priority: Major
>
> According to
> https://github.com/adobe/htl-spec/blob/master/SPECIFICATION.md#121-display-context
> the context {{scriptString}} should only encode
> {quote}
> ... characters that would break out of the string.
> {quote}
> But {{AAA-BBB}} incorrectly becomes {{AAA\u002DBBB}} through this context
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
