[
https://issues.apache.org/jira/browse/WICKET-6178?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106665#comment-18106665
]
ASF subversion and git services commented on WICKET-6178:
---------------------------------------------------------
Commit 207b083e2d50dd13ece28e9293faa2c86275ac20 in wicket's branch
refs/heads/wicket-9.x from Emond Papegaaij
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=207b083e2d ]
Escape the attribute values of a MetaDataHeaderItem as markup
generateString escaped attribute names with Strings.escapeMarkup but ran the
values through Strings.replaceAll(value, "\"", "\\\""). A backslash before a
double quote means nothing in HTML, so a value holding a double quote ended its
own attribute and whatever followed was read as further attributes. Values may
come from an IModel, so they are not necessarily literals. WICKET-6178 set out
to
escape these values and this is what it left behind.
They now go through Strings.escapeMarkup, like the names beside them and like
every attribute ComponentTag writes.
Two tests asserted the old output. testEscapeOnlyDoubleQuotes was named after
the
behaviour that was the problem and is renamed. HtmlImportHeaderItemTest expects
an escaped ampersand in the href of a link tag, which is what a url holding two
parameters has to carry, and is what ComponentTag writes for every other
attribute.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
> MetaDataHeaderItem # generateString() should return specials characters
> escaped like StringEscapeUtils.escapeHtml(s) does
> -------------------------------------------------------------------------------------------------------------------------
>
> Key: WICKET-6178
> URL: https://issues.apache.org/jira/browse/WICKET-6178
> Project: Wicket
> Issue Type: Improvement
> Components: wicket
> Affects Versions: 7.3.0, 6.23.0
> Reporter: Francois
> Assignee: Andrea Del Bene
> Priority: Minor
> Fix For: 8.0.0-M1, 7.4.0, 6.24.0
>
>
> I think MetaDataHeaderItem # generateString() should return specials
> characters escaped like
> StringEscapeUtils.escapeHtml(s) does.
> Apache Wicket 7.3.0 - MetaDataHeaderItem - Line 126 :
> append(JavaScriptUtils.escapeQuotes(value.toString()))
> return qwerty'qwerty as qwerty\’qwerty
> I would like the return to be qwerty'qwerty (for example for the metatag
> description).
> Martin's answer :
> Looking at
> https://github.com/apache/wicket/blob/39fb20b112e2005dab8e17667e5a763b1d89f18e/wicket-core/src/main/java/org/apache/wicket/markup/head/MetaDataHeaderItem.java#L125-L127
> I agree that only double quotes should be escaped because only double
> quotes may end prematurely the value.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
