[WICKET-2829] Tag attributes values are not escaped properly during writeOutput

• Type: Improvement
• Status: Resolved
• Priority: Trivial
• Resolution: Fixed
• Affects Version/s: 1.4.7
• Fix Version/s: 1.5-RC1
• Component/s: wicket
• Environment: Wicket 1.4.7
• Assignee: Martin Tzvetanov Grigorov
• Reporter: Rodrigo Faria
• Created: 08/Apr/10 15:52
• Updated: 11/Jul/13 13:08
• Resolved: 29/Dec/10 14:36

Description

In WICKET-741, the double quote character was escaped. But the characters: ' (single quote) and & (ampersand) are not escaped.
With & not escaped, if it is included in an attribute value, the result is not XML compliant and XHTML validations marks it as an error.
With ' not escaped, if single quote is used instead of double quote as in:
<tag attribute='value'/>
The result will be broken just as double quote was before WICKET-741.

I'm not sure if < and > characters should also be escaped. Some validators/parsers allow them, but some other mark them as errors. I would also replace them.

I suggest adding the lines marked below to ComponentTag.writeOutput:
—
// attributes without values are possible, e.g.' disabled'
if (value != null)
{
response.write("=\"");
value = Strings.replaceAll(value, "&", "&"); // <--- added
value = Strings.replaceAll(value, "\"", """);
value = Strings.replaceAll(value, "\'", "'"); // <----- added
value = Strings.replaceAll(value, "<", "<"); // <----- added
value = Strings.replaceAll(value, ">", ">"); // <----- added
response.write(value);
response.write("\"");
}
—

Issue Links

• breaks: WICKET-3608 input button escapes escaped value
• relates to: WICKET-5242 Disable escaping of html tag attributes