Remove potential XSS attack in Freemarker example

Since the user controls the value of `spring.status.value`, you wouldn't want to echo unescaped values here in this form. Otherwise one could submit a value of, say, `"/> <script>alert("pwned")</script>`.
This commit is contained in:
John Feminella
2016-05-05 14:23:14 -04:00
parent a1a87679da
commit 2367f52aaf

View File

@@ -331,7 +331,7 @@ Example code is shown below for the `personFormV`/`personFormF` views configured
<@spring.bind "myModelObject.name"/>
<input type="text"
name="${spring.status.expression}"
value="${spring.status.value?default("")}"/><br>
value="${spring.status.value?html}"/><br>
<#list spring.status.errorMessages as error> <b>${error}</b> <br> </#list>
<br>
...