Details
-
New Feature
-
Status: Resolved
-
Major
-
Resolution: Won't Fix
-
Scripting HTL Engine 1.3.2-1.4.0
-
None
-
None
Description
url=http://test.com/?a=true&b=false&c=%3F
<a href="${url}">Test</a>
I expect the href to be (when viewing page source):
http://test.com/?a=true&b=false&c=%3F
It however is:
http://test.com/?a=true&b=false&c=%3F
HTML requires attributes to also be encoded, so I believe we're not doing enough to do the proper encoding/escaping here.
WDYT?
Attachments
Issue Links
- is fixed by
-
SLING-9694 XSSAPIImpl#getValidHref does not escape the ampersand character
- Resolved