StringEscapeUtils.escapeJavaScript() method did not escape '/' into '\/', it will make IE render page uncorrectly

• Key: LANG-363
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Minor
• Assignee: Unassigned
• Reporter: Situ Chenghao
• Affects Version/s: 2.3
• Fix Version/s: 2.4

Description

If Javascripts including'/', IE will parse the scripts uncorrectly, actually '/' should be escaped to '\/'.
For example, document.getElementById("test").value = '<script>alert(\'aaa\');</script>';this expression will make IE render page uncorrect, it should be document.getElementById("test").value = '<script>alert(\'aaa\');<\/script>';

Btw, Spring's JavascriptEscape behavor is correct.
Try to run below codes, you will find the difference:
String s = "<script>alert('aaa');</script>";
String str = org.springframework.web.util.JavaScriptUtils.javaScriptEscape(s);
System.out.println("Spring JS Escape : "+str);
str = org.apache.commons.lang.StringEscapeUtils.escapeJavaScript(s);
System.out.println("Apache Common Lang JS Escape : "+ str);

Comments

[Scott Bassin]

Here's a patch that should fix the issue described. Also included is an extra assertion in testEscapeJavaScript of StringEscapeUtilsTest.

[Henri Yandell]

Heh - I even had a play with this when looking at the Spring one: http://opensource.atlassian.com/projects/spring/browse/SPR-1754

Not sure why I didn't submit a fix, probably too green with Spring at the time.

[Henri Yandell]

Thanks again Scott (and Situ for reporting it), patch applied:

svn ci -m "Applying Scott Bassin's fix and test from LANG-363" src/test/org/apache/commons/lang/StringEscapeUtilsTest.java src/java/org/apache/commons/lang/StringEscapeUtils.java

Sending src/java/org/apache/commons/lang/StringEscapeUtils.java
Sending src/test/org/apache/commons/lang/StringEscapeUtilsTest.java
Transmitting file data ..
Committed revision 588534.

[Gary Gregory]

fix typo in summary field

[Henri Yandell]

See LANG-437 for conversation about rolling this fix back. There are user complaints on the list that the change is causing problems.