paulk-asert opened a new pull request, #2814:
URL: https://github.com/apache/groovy/pull/2814
Two places where groovydoc builds HTML around text taken from the source it
is documenting, without encoding it for the context it lands in.
A {@link} or @see reference is split into a target and a label, both of
which are then concatenated into an anchor the tool constructs: the target into
href, the label into the element text, and for a resolved class the short name
into title as well. None was encoded, so a reference could close the attribute
and open a tag of its own. Encode each for its context, the attributes through
encodeAttribute and the text through encodeAngleBrackets.
An annotation's name and description are emitted into the class declaration
and every member heading. description() carries the annotation's arguments as
they were written, so an annotation holding a string literal put that literal
into the page verbatim. Encode both, leaving the linkable() call alone since
that one does produce markup.
This is groovydoc's own construction rather than the raw HTML a doc comment
body may contain by javadoc parity, so the passthrough that covers a comment
body does not extend to it. For the annotation case the text is not from a
comment at all: it is source code, and reaches the page without any doc comment
being written.
Not changed: the @default tag GroovydocJavaVisitor appends for an annotation
member's default value. It is added to the raw comment text and no template
renders it as a declaration, and constantValueExpression() is only tested for
nullity, so that value does not reach a declaration block.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
