paulk-asert opened a new pull request, #2815:
URL: https://github.com/apache/groovy/pull/2815
…re not names
MarkupTemplateEngine writes element text through escapeXml, so a template
author can reasonably read the engine as treating the values it is given as
data. The attribute path did not hold up that reading. A value was escaped only
for the quote character configured as the delimiter, and an attribute name was
written exactly as it arrived.
Escape a value for the delimiter, as before, and additionally for the
ampersand and the angle brackets, which are not well formed inside an attribute
value whichever quote surrounds it. The other quote character is neither unsafe
nor ill formed there, so it is left as written and output is unchanged for
every value that was already well formed.
Refuse an attribute name which is not a name. A name has no escaped form:
escaping one produces a different name rather than a safe version of the same
one, so a name arriving from data is checked and rejected instead. This is the
half with teeth, since a map key such as
x='1' onmouseover='alert(1)'
was previously written out and introduced attributes of its own.
Doing so surfaced that xmlDeclaration passed " encoding" as an attribute
name, using a leading space as a separator; the space is now written separately
and the name is a name.
escapeQuotes had no remaining caller and is removed.
Behaviour change worth a release note: a template which places an ampersand
or an angle bracket in an attribute value now emits it escaped, and one which
builds attribute names from data will fail rather than emit markup whose shape
the data chose.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
