[WW-2427] s:a does not HTML-escape "href" attribute value

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.11
• Fix Version/s: 2.0.11.1, 2.1.1
• Component/s: Plugin - Tags
• Assignee: Donald J. Brown
• Reporter: Antonio Petrelli
• Created: 16/Jan/08 08:46
• Updated: 02/May/13 02:28
• Resolved: 25/Feb/08 06:28

Description

The <s:a> does not escape with HTML entities the "href" attribute value. This can lead to invalid HTML and, in certain cases, to
XSS attacks.
Probably a new attribute, that specify if the escape is enabled or not, should be added.

Issue Links

• is depended upon by: WW-2414 Tags <s:url> and <s:a> do not encode URLs