Uploaded image for project: 'NetBeans'
  1. NetBeans
  2. NETBEANS-720

HTML injection in search result tab titles and MRU dropdown list

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Open
    • Minor
    • Resolution: Unresolved
    • 8.2, 9.0, Next
    • None
    • utilities - Search
    • None

    Description

      When searching for something like <html><b>HTML</b> <i>injection</i> search tab titles and the MRU dropdown list in the search dialog show the HTML formatted text, not the raw input. This also means searching for <html> produces a tab with an empty title.

      Found in NetBeans 8.2, reproduced with the latest build incubator-netbeans-release-272-on-20180418.

      (I’d attach a screenshot but JIRA complains about a missing token.)

      HTML can be disabled with something like

      public static void disableHtml(final JComponent component) {
          component.putClientProperty("html.disable", Boolean.TRUE);
      }
      (see http://www.oracle.com/technetwork/java/seccodeguide-139067.html#3-7)

      Attachments

        Activity

          People

            Unassigned Unassigned
            striderapache dennis lucero
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: