Remove potential XSS attack in Freemarker example
Since the user controls the value of `spring.status.value`, you wouldn't want to echo unescaped values here in this form. Otherwise one could submit a value of, say, `"/> <script>alert("pwned")</script>`.
This commit is contained in:
@@ -331,7 +331,7 @@ Example code is shown below for the `personFormV`/`personFormF` views configured
|
||||
<@spring.bind "myModelObject.name"/>
|
||||
<input type="text"
|
||||
name="${spring.status.expression}"
|
||||
value="${spring.status.value?default("")}"/><br>
|
||||
value="${spring.status.value?html}"/><br>
|
||||
<#list spring.status.errorMessages as error> <b>${error}</b> <br> </#list>
|
||||
<br>
|
||||
...
|
||||
|
||||
Reference in New Issue
Block a user