[
https://issues.apache.org/jira/browse/WW-5824?focusedWorklogId=1051589&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1051589
]
ASF GitHub Bot logged work on WW-5824:
--------------------------------------
Author: ASF GitHub Bot
Created on: 31/Oct/26 09:23
Start Date: 31/Oct/26 09:23
Worklog Time Spent: 10m
Work Description: lukaszlenart opened a new pull request, #2080:
URL: https://github.com/apache/struts/pull/2080
Fixes [WW-5824](https://issues.apache.org/jira/browse/WW-5824)
Port of #2079 to the 6.x line. The 6.x branch has no html5 theme and its
templates still name the model `parameters`, so this is a manual port of the
same change rather than a cherry-pick.
The radio template was the only bundled form template writing the `name`
attribute with `?no_esc`. Every sibling template writes it under the FreeMarker
auto-escaping configured for the UI templates, and the javatemplates plugin
escapes it through `Attributes.addDefaultToEmpty`. The exception dates from the
original template, which never carried the per-parameter `?html` the checkbox
template had, and WW-4972 preserved that output with an explicit `?no_esc` when
the templates moved to built-in auto-escaping.
## Change
Drop `?no_esc` from the `name` attribute in `simple/radiomap.ftl`. The
`xhtml` and `css_xhtml` themes include the `simple` template, so they pick it
up as well.
## Compatibility
A radio name containing `"`, `'`, `<`, `>` or `&` is now entity-encoded in
the rendered attribute, as on every other tag. The browser decodes the entities
before submission, so the submitted parameter name is unchanged. Names without
those characters render exactly as before.
## Tests
`RadioTest` gains `testNameIsEscaped`, rendering a name with a double quote
under the `simple` theme and pinning the escaped output in `Radio-12.txt`; it
fails before the change. `Radio-6.txt` pins a name with apostrophes and now
carries them as `'`, the form the combobox fixtures already use. The core
UI tag and FreeMarker view test packages pass on this branch.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Issue Time Tracking
-------------------
Worklog Id: (was: 1051589)
Time Spent: 0.5h (was: 20m)
> Radio tag renders its name attribute without HTML escaping, unlike every
> other form tag
> ---------------------------------------------------------------------------------------
>
> Key: WW-5824
> URL: https://issues.apache.org/jira/browse/WW-5824
> Project: Struts 2
> Issue Type: Bug
> Components: Core Tags
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Minor
> Fix For: 6.13.0, 7.5.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> The radio template is the only bundled form template that writes the {{name}}
> attribute with {{?no_esc}}. Every sibling template (checkbox, checkboxlist,
> text, select, file, hidden, password, textarea, submit, reset, form) writes
> it under the FreeMarker auto-escaping configured for the UI templates, and
> the javatemplates plugin escapes it as well.
> The exception dates from the original template, which never carried the
> per-parameter {{?html}} the checkbox template had. When the templates moved
> to built-in auto-escaping in WW-4972, the radio template kept its previous
> output by adding {{?no_esc}} to that one attribute.
> h2. Current behaviour
> A radio with a name containing a double quote, rendered under the {{simple}},
> {{xhtml}} or {{html5}} theme, closes the attribute early:
> {code}<input type="radio" name="x" onfocus="alert(1)"
> id="x__onfocus__alert_1_a" value="a"/>
> {code}
> A checkboxlist with the same name renders the quote as {{"}}.
> h2. Expected behaviour
> The radio name is written the same way as on every other tag, HTML-escaped.
> h2. Change
> Remove {{?no_esc}} from the {{name}} attribute in the {{simple}} and
> {{html5}} radio templates and pin the escaped output with a test. One
> existing fixture, Radio-6.txt, pins a name containing apostrophes;
> auto-escaping renders those as {{'}}, as the combobox fixtures already
> show.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
