[SHALE-488] Script contents should be enclosed in CDATA section for XML documents

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.0.4
• Component/s: Validator
• Environment: XML content types, including XHTML
• Assignee: Unassigned
• Reporter: Jeff Tsay
• Created: 20/Apr/08 08:36
• Updated: 09/Jun/08 14:45

Description

When the validator script gets rendered, it outputs raw Javascript inside the <script>
tags. The Javascript includes characters like & which need to be escaped
or in a CDATA section in XML. For XUL or XHTML, this is a problem. I
guess that XHTML parsers are more lenient about this so that's why the
problem never showed up? Anyway the fix, which was also suggested by
Gary VanMatre, was to enclose the script contents in an XML CDATA
section. So in
src/main/java/org/apache/shale/validator/faces/ValidatorScript.java I have:

private void writeScriptStart(ResponseWriter writer) throws IOException {
writer.startElement("script", this);
writer.writeAttribute("type", "text/javascript", null);
writer.writeAttribute("language", "Javascript1.1", null);
writer.write("\n");

// jtsay added
// Enclose XML in CDATA so special characters can be used without
escaping.
if (!"text/html".equals(writer.getContentType()))

{ writer.write("<![CDATA[\n"); }

}

and

private void writeScriptEnd(ResponseWriter writer) throws IOException {
// jtsay added
if (!"text/html".equals(writer.getContentType()))

{ writer.write("\n]]>\n"); }

writer.write("\n");
writer.endElement("script");
}

This assumes if we are not rendering text/html, we must be rendering
some sort of XML. Sound reasonable?