Uploaded image for project: 'OFBiz'
  1. OFBiz
  2. OFBIZ-4042

ecommerce keyword search - Non-breaking space displayed as literal ampersand-nbsp-semicolon

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    Description

      On demo site, navigate to http://demo-trunk.ofbiz.apache.org/ecommerce/control/main. In Search Catalog box on the left, enter a keyword that isn't in the product descriptions, such as "notthere", and click on Find. The results page, http://demo-trunk.ofbiz.apache.org/ecommerce/control/keywordsearch, displays a list of "X" buttons, which would exclude some search results if there were any. Beside each "X" button is a sequence of an ampersand, the letters "nbsp" and a semi-colon. When I do a View Source in my web browser, the sequence is the HTML ampersand entity, then nbsp, then a literal semicolon.

      Obviously something is HTML encoding what was originally intended to be a non-breaking space. I can see the non-breaking space entity in applications/product/webapp/catalog/find/keywordsearch.ftl .

      Of course it is necessary to HTML encode any untrusted data coming from the client side to guard against cross site scripting attacks. I don't see why it is necessary to HTML encode the contents of a FreeMarker template, and I don't understand why this non-breaking space is being encoded, and not every occurrence of a greater-than or a less-than in the template.

      Attachments

        Issue Links

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            jleroux Jacques Le Roux
            paulfoxworthy Paul Foxworthy
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Issue deployment