This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a commit to branch support/struts-6-x-x
in repository https://gitbox.apache.org/repos/asf/struts.git
The following commit(s) were added to refs/heads/support/struts-6-x-x by this
push:
new 97a7dfebb WW-5824 fix(core): escape the radio name attribute like
every other tag
97a7dfebb is described below
commit 97a7dfebb925e744efe3995b50713983e54c5535
Author: Lukasz Lenart <[email protected]>
AuthorDate: Sat Oct 31 10:22:52 2026 +0100
WW-5824 fix(core): escape the radio name attribute like every other tag
The radio template was the only bundled form template writing the name
attribute with ?no_esc. The exception dates from the original template,
which never carried the per-parameter ?html the checkbox template had,
and WW-4972 preserved that output when the templates moved to built-in
auto-escaping. Drop the opt-out in the simple template and pin the
escaped name in RadioTest; Radio-6.txt now carries the apostrophes of
its name as ', as the combobox fixtures already do.
Port of cedc6edd1 from main: the 6.x line has no html5 theme and still
names the template model "parameters".
Co-Authored-By: Claude Mythos 5.1 <[email protected]>
---
core/src/main/resources/template/simple/radiomap.ftl | 2 +-
.../java/org/apache/struts2/views/jsp/ui/RadioTest.java | 17 +++++++++++++++++
.../org/apache/struts2/views/jsp/ui/Radio-12.txt | 2 ++
.../org/apache/struts2/views/jsp/ui/Radio-6.txt | 6 +++---
4 files changed, 23 insertions(+), 4 deletions(-)
diff --git a/core/src/main/resources/template/simple/radiomap.ftl
b/core/src/main/resources/template/simple/radiomap.ftl
index 597300e95..e69c733df 100644
--- a/core/src/main/resources/template/simple/radiomap.ftl
+++ b/core/src/main/resources/template/simple/radiomap.ftl
@@ -63,7 +63,7 @@
</#if>
<input type="radio"<#rt/>
<#if parameters.name?has_content>
- name="${parameters.name?no_esc}"<#rt/>
+ name="${parameters.name}"<#rt/>
</#if>
id="${parameters.id}${itemKeyStr?replace(".", "_")}"<#rt/>
<#if tag.contains(parameters.nameValue!'', itemKey)>
diff --git a/core/src/test/java/org/apache/struts2/views/jsp/ui/RadioTest.java
b/core/src/test/java/org/apache/struts2/views/jsp/ui/RadioTest.java
index 47a5caad7..3874a1941 100644
--- a/core/src/test/java/org/apache/struts2/views/jsp/ui/RadioTest.java
+++ b/core/src/test/java/org/apache/struts2/views/jsp/ui/RadioTest.java
@@ -665,6 +665,23 @@ public class RadioTest extends AbstractUITagTest {
strutsBodyTagsAreReflectionEqual(tag, freshTag));
}
+ public void testNameIsEscaped() throws Exception {
+ TestAction testAction = (TestAction) action;
+ Map<String, String> map = new LinkedHashMap<>();
+ map.put("a", "A");
+ testAction.setMap(map);
+
+ RadioTag tag = new RadioTag();
+ tag.setTheme("simple");
+ tag.setPageContext(pageContext);
+ tag.setName("myname\" onfocus=\"alert(1)");
+ tag.setList("map");
+ tag.doStartTag();
+ tag.doEndTag();
+
+ verify(RadioTag.class.getResource("Radio-12.txt"));
+ }
+
private void prepareTagGeneric(RadioTag tag) {
TestAction testAction = (TestAction) action;
testAction.setFoo("bar");
diff --git
a/core/src/test/resources/org/apache/struts2/views/jsp/ui/Radio-12.txt
b/core/src/test/resources/org/apache/struts2/views/jsp/ui/Radio-12.txt
new file mode 100644
index 000000000..dfc29161f
--- /dev/null
+++ b/core/src/test/resources/org/apache/struts2/views/jsp/ui/Radio-12.txt
@@ -0,0 +1,2 @@
+<input type="radio" name="myname" onfocus="alert(1)"
id="myname__onfocus__alert_1_a" value="a"/>
+<label for="myname__onfocus__alert_1_a">A</label>
diff --git
a/core/src/test/resources/org/apache/struts2/views/jsp/ui/Radio-6.txt
b/core/src/test/resources/org/apache/struts2/views/jsp/ui/Radio-6.txt
index 8c7f20bad..11f619c2a 100644
--- a/core/src/test/resources/org/apache/struts2/views/jsp/ui/Radio-6.txt
+++ b/core/src/test/resources/org/apache/struts2/views/jsp/ui/Radio-6.txt
@@ -1,11 +1,11 @@
<tr>
<td class="tdLabel"></td>
<td class="tdInput">
- <input type="radio" name="myMap['name']" id="myMap__name__"value=""/>
+ <input type="radio" name="myMap['name']"
id="myMap__name__"value=""/>
<label for="myMap__name__">N/A</label>
- <input type="radio" name="myMap['name']" id="myMap__name__Opt_"
value="Opt."/>
+ <input type="radio" name="myMap['name']"
id="myMap__name__Opt_" value="Opt."/>
<label for="myMap__name__Opt_">Opt.</label>
- <input type="radio" name="myMap['name']" id="myMap__name__Std_"
checked="checked" value="Std."/>
+ <input type="radio" name="myMap['name']"
id="myMap__name__Std_" checked="checked" value="Std."/>
<label for="myMap__name__Std_">Std.</label>
</td>
</tr>
