[SLING-6008] The display context cannot be overwritten for HTML attribute expressions - ASF JIRA

XML

Word

Printable

JSON

The XSS display context cannot be overwritten any more for expressions that should generate the value of HTML attributes:

Markup:

<a data-sly-use.urltype="logic.js" href="${urltype.hrefValue @ context='unsafe'}">Click</a>

Logic:

use(function () {
    return {
        hrefValue: "$link.category('default','men','')"
    };
});

Current output:

<a href="$link.category(%27default%27,%27men%27,%27%27)">Click</a>

However, with context='unsafe', the output should actually be:

<a href="$link.category('default','men','')">Click</a>

is caused by

SLING-5568 Sightly filters don't remove their specific options from the expression during processing