From 366366cdd8bbb129eaad05eb00dfca6e09afac05 Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukaszlenart@apache.org>
Date: Fri, 11 Nov 2016 11:57:29 +0100
Subject: [PATCH] WW-4712 Escapes default message

---
 .../main/java/org/apache/struts2/util/TextProviderHelper.java | 4 ++++
 .../test/java/org/apache/struts2/views/jsp/TextTagTest.java   | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/core/src/main/java/org/apache/struts2/util/TextProviderHelper.java b/core/src/main/java/org/apache/struts2/util/TextProviderHelper.java
index 1c19a2f03..c6e9679b8 100644
--- a/core/src/main/java/org/apache/struts2/util/TextProviderHelper.java
+++ b/core/src/main/java/org/apache/struts2/util/TextProviderHelper.java
@@ -23,6 +23,7 @@ package org.apache.struts2.util;
 
 import com.opensymphony.xwork2.TextProvider;
 import com.opensymphony.xwork2.util.ValueStack;
+import org.apache.commons.lang3.StringEscapeUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 
@@ -86,6 +87,9 @@ public class TextProviderHelper {
             if (msg == null) {
                 // use the defaultMessage literal value
                 msg = defaultMessage;
+                msg = StringEscapeUtils.escapeEcmaScript(msg);
+                msg = StringEscapeUtils.escapeHtml4(msg);
+                LOG.debug("Message for key '{}' is null, returns escaped default message [{}]", key, msg);
             }
 
             if (LOG.isWarnEnabled()) {
diff --git a/core/src/test/java/org/apache/struts2/views/jsp/TextTagTest.java b/core/src/test/java/org/apache/struts2/views/jsp/TextTagTest.java
index 729ecafc3..661acd32e 100644
--- a/core/src/test/java/org/apache/struts2/views/jsp/TextTagTest.java
+++ b/core/src/test/java/org/apache/struts2/views/jsp/TextTagTest.java
@@ -274,7 +274,7 @@ public class TextTagTest extends AbstractTagTest {
 
     public void testWithNoMessageAndNoDefaultKeyReturned() throws JspException {
         final String key = "key.does.not.exist";
-        tag.setName("'" + key + "'");
+        tag.setName(key);
         tag.doStartTag();
         tag.doEndTag();
         assertEquals(key, writer.toString());