Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

HtmlUtils properly escapes single quotes as well

Browse Source
This commit is contained in:
Juergen Hoeller
2011-07-27 21:22:39 +00:00
parent b122cf87df
commit d48c3b5d4f
5 changed files with 41 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
org.springframework.web.servlet/src/test/java/org/springframework/web/servlet/tags/HtmlEscapeTagTests.java
View File

@@ -1,12 +1,12 @@
/*
* Copyright 2002-2005 the original author or authors.
*
* Copyright 2002-2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
*
* http://www.apache.org/licenses/LICENSE-2.0
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -18,8 +18,8 @@ package org.springframework.web.servlet.tags;
import javax.servlet.jsp.JspException;
import javax.servlet.jsp.PageContext;
import javax.servlet.jsp.tagext.Tag;
import javax.servlet.jsp.tagext.BodyTag;
import javax.servlet.jsp.tagext.Tag;
import org.springframework.mock.web.MockServletContext;
import org.springframework.web.util.WebUtils;
@@ -176,7 +176,7 @@ public class HtmlEscapeTagTests extends AbstractTagTests {
tag.setJavaScriptEscape("true");
assertEquals(BodyTag.EVAL_BODY_BUFFERED, tag.doStartTag());
assertEquals(Tag.SKIP_BODY, tag.doAfterBody());
assertEquals("Correct content", "\\' test & text \\\\", result.toString());
assertEquals("Correct content", "' test & text \\\\", result.toString());
}
}

5
org.springframework.web.servlet/src/test/java/org/springframework/web/servlet/tags/MessageTagTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2007 the original author or authors.
* Copyright 2002-2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -19,7 +19,6 @@ package org.springframework.web.servlet.tags;
import java.util.Arrays;
import java.util.List;
import java.util.Locale;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.jsp.JspException;
@@ -347,7 +346,7 @@ public class MessageTagTests extends AbstractTagTests {
tag.setHtmlEscape("true");
tag.setJavaScriptEscape("true");
assertTrue("Correct doStartTag return value", tag.doStartTag() == Tag.EVAL_BODY_INCLUDE);
assertEquals("Correct message", "\\' test & text \\\\", message.toString());
assertEquals("Correct message", "' test & text \\\\", message.toString());
}
public void testMessageWithVarAndScope() throws JspException {

4
org.springframework.web.servlet/src/test/java/org/springframework/web/servlet/tags/form/FormTagTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2008 the original author or authors.
* Copyright 2002-2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -174,7 +174,7 @@ public class FormTagTests extends AbstractHtmlElementTagTests {
String xssQueryString = QUERY_STRING + "&stuff=\"><script>alert('XSS!')</script>";
request.setQueryString(xssQueryString);
tag.doStartTag();
assertEquals("<form id=\"command\" action=\"/my/form?foo=bar&amp;stuff=&quot;&gt;&lt;script&gt;alert('XSS!')&lt;/script&gt;\" method=\"post\">",
assertEquals("<form id=\"command\" action=\"/my/form?foo=bar&amp;stuff=&quot;&gt;&lt;script&gt;alert(&#39;XSS!&#39;)&lt;/script&gt;\" method=\"post\">",
getOutput());
}