Nearly:
<s:text name="#parameters.get('error').value"/>
This is now blocked :
#parameters.get('error').value
But:
<s:text name="#parameters.error"/>
Does the popup!
#####
Also, if I modify my class for HttpParametersAware and use the new
HttpParameters
ie
public void setParameters(HttpParameters parameters) {
this.params = parameters.toMap();
}
public String getParameter(String key) {
String[] p = (String[]) this.params.get(key);
if (p != null && p.length > 0) {
return p[0];
}
return null;
}
then :
<s:text name="getParameter('error')" />
I also get the popup
On 8 November 2016 at 10:44, Lukasz Lenart <[email protected]> wrote:
> Pushed changes to the repo, you can test with the latest SNAPSHOT version
>
> 2016-11-02 10:28 GMT+01:00 Lukasz Lenart <[email protected]>:
> > 2016-11-02 9:19 GMT+01:00 Lukasz Lenart <[email protected]>:
> >> 2016-11-02 9:12 GMT+01:00 Greg Huber <[email protected]>:
> >>> Looking at this:
> >>>
> >>> <s:if test="#parameters.contains('error')">
> >>> <ul><li>
> >>> <s:text name="#parameters.get('error').value"/>
> >>> </li></ul>
> >>> </s:if>
> >>>
> >>> and if I use :
> >>>
> >>> login.action?error=<script type="text/javascript">alert("
> ok1");</script>
> >>>
> >>> I get a js alert box popup.
> >>>
> >>> Should it be able to popup the alert box? Thought this kind of script
> >>> should be escaped.
> >>
> >> Yeah, that's why calling directly .value in your scriplet isn't a good
> >> practise and I want to add a dedicated converter/accessor for
> >> HttpParameters to avoid such situation.
> >
> > Small progress
> >
> > These don't work as access to .value is not allowed
> > Test: <s:property value="%{#parameters.message.value}"/>
> > Test: <s:property value="%{#parameters.get('message').value}"/>
> > Test: <s:text name="%{#parameters.message.value}"/>
> > Test: <s:text name="%{#parameters.get('message').value}"/>
> >
> > These work and are safe
> > Test: <s:property value="%{#parameters.message}"/>
> > Test: <s:text name="%{#parameters.message}"/>
> >
> >
> > Regards
> > --
> > Łukasz
> > + 48 606 323 122 http://www.lenart.org.pl/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
>
