[ https://issues.apache.org/jira/browse/SLING-6438?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Radu Cotescu reassigned SLING-6438: ----------------------------------- Assignee: Radu Cotescu > Add encodeForHTMLAttrName() to XSSAPI > ------------------------------------- > > Key: SLING-6438 > URL: https://issues.apache.org/jira/browse/SLING-6438 > Project: Sling > Issue Type: Improvement > Components: XSS Protection API > Affects Versions: XSS Protection API 1.0.16 > Reporter: Lars Krapf > Assignee: Radu Cotescu > > The XSSAPI currently does not provide a method to safely encode HTML > attribute names. This could cause problems if for example attackers were > allowed to define arbitrary "data-" attributes. I don't think Encoder already > provides a context for that, but {{forHtmlUnquotedAttribute}} might just do > the trick. -- This message was sent by Atlassian JIRA (v6.3.4#6332)