[TAP5-2179] The Select component can be hacked to select a value not in the SelectModel

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.3, 5.4
• Fix Version/s: 5.4
• Component/s: tapestry-core
• Assignee: Howard Lewis Ship
• Reporter: Howard Lewis Ship
• Created: 12/Sep/13 00:43
• Updated: 29/Apr/14 07:50
• Resolved: 12/Sep/13 00:45

Description

Through 5.3, the Select component uses the SelectModel only for rendering. This means that a clever hacker could force through a selection of a value not intended by the programmer. The Select component should (optionally, but by default) validate that the selected value appears inside the SelectModel.

Issue Links

• breaks: TAP5-2245 select component: selected option is not listed in the model.