PUBLIC - Liferay Portal Community Edition

Change HtmlUtil.escapeAttribute(HtmlUtil.escapeHREF(...)) to HtmlUtil.escapeHREF(...)

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Minor Minor
  • Resolution: Fixed
  • Affects Version/s: 6.1.1 CE GA2, 6.1.20 EE GA2
  • Fix Version/s: 6.1.X EE, 6.2.0 CE M5
  • Component/s: API, API > Utils
  • Labels:
  • Branch Version/s:
    6.1.x
  • Backported to Branch:
    Committed
  • Similar Issues:
    Show 4 results 

Description

Change HtmlUtil.escapeAttribute(HtmlUtil.escapeHREF(...)) to HtmlUtil.escapeHREF(...) so that it's easier to escape HREF (i.e., escapeHREF should automatically call escapeAttribute). Since href is also an attribute, we can safely make this change.

Issue Links

is related to

Bug - A problem which impairs or prevents the functions of the product. LPS-33183 XSS vulnerability on page which type is "Embedded"

  • Minor - Minor loss of function, or other problem where easy workaround is present.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Brian Chan added a comment -

This ticket is required by LPS-33183

Show
Brian Chan added a comment - This ticket is required by LPS-33183
Hide
Permalink
Michael Saechang added a comment -

Committed on:
Portal 6.2.x GIT ID: c302c076fcd61309df5939ab37530e0609c60d71.

Show
Michael Saechang added a comment - Committed on: Portal 6.2.x GIT ID: c302c076fcd61309df5939ab37530e0609c60d71.

People

Vote (0)
Watch (0)

Dates

  • Created:
    Updated:
    Resolved:
    Days since last comment:
    12 weeks ago