ecommerce keyword search - Non-breaking space displayed as literal
ampersand-nbsp-semicolon
-------------------------------------------------------------------------------------------
Key: OFBIZ-4042
URL: https://issues.apache.org/jira/browse/OFBIZ-4042
Project: OFBiz
Issue Type: Bug
Components: specialpurpose/ecommerce
Affects Versions: SVN trunk
Reporter: Paul Foxworthy
Priority: Minor
On demo site, navigate to
http://demo-trunk.ofbiz.apache.org/ecommerce/control/main. In Search Catalog
box on the left, enter a keyword that isn't in the product descriptions, such
as "notthere", and click on Find. The results page,
http://demo-trunk.ofbiz.apache.org/ecommerce/control/keywordsearch, displays a
list of "X" buttons, which would exclude some search results if there were any.
Beside each "X" button is a sequence of an ampersand, the letters "nbsp" and a
semi-colon. When I do a View Source in my web browser, the sequence is the HTML
ampersand entity, then nbsp, then a literal semicolon.
Obviously something is HTML encoding what was originally intended to be a
non-breaking space. I can see the non-breaking space entity in
applications/product/webapp/catalog/find/keywordsearch.ftl .
Of course it is necessary to HTML encode any untrusted data coming from the
client side to guard against cross site scripting attacks. I don't see why it
is necessary to HTML encode the contents of a FreeMarker template, and I don't
understand why this non-breaking space is being encoded, and not every
occurrence of a greater-than or a less-than in the template.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
