[WW-3047] doubleselect does not escape quotes in doublelist values

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.14
• Fix Version/s: 2.3.1

Environment

Tomcat 5.5.17, Windows XP SP2, Firefox 3.0.7

• Assignee: Lukasz Lenart
• Reporter: Lee Clemens
• Created: 19/Mar/09 00:57
• Updated: 02/May/13 02:29
• Resolved: 11/Oct/11 05:51

Description

Using:

<s:doubleselect name="priId" doubleName="subId"
list="mainList" doubleList="subList"
listKey="value" doubleListKey="value"
listValue="label" doubleListValue="label"/>

mainList is a class which contains getSubList(), which returns a list for the second drop down.
Both Lists contain classes which contain getValue() and getLabel() methods.

A quoted value is properly escaped if from the 'list'; however, the 'doublelist' values are not escaped:

Example of resultant HTML:

List is escaped:

<option value="abc">"quotedString"</option>

However, generated JavaScript for the doubleselect is not escaped:

FormName_doubleSelectFoo[123][0] = new Option(""quotedString"", "123");

Which causes the second drop down box to only contain an empty option (presumably from error in JavaScript).

I haven't tested this to ensure it escapes the Labels, however the same issue may be present there.

Issue Links

• depends upon: WW-2750 JavaScript errors due to hyphens in action names