diff --git a/apps/showcase/src/main/resources/template/ajaxErrorContainers/actionerror.ftl b/apps/showcase/src/main/resources/template/ajaxErrorContainers/actionerror.ftl index e5ba7fb06..9988a6cb6 100644 --- a/apps/showcase/src/main/resources/template/ajaxErrorContainers/actionerror.ftl +++ b/apps/showcase/src/main/resources/template/ajaxErrorContainers/actionerror.ftl @@ -23,21 +23,21 @@ --> <#if parameters.id??> - id="${parameters.id?html}"<#rt/> + id="${parameters.id}"<#rt/> <#if parameters.cssClass??> - class="${parameters.cssClass?html}"<#rt/> + class="${parameters.cssClass}"<#rt/> <#else> class="errorMessage"<#rt/> <#if parameters.cssStyle??> - style="${parameters.cssStyle?html}"<#rt/> + style="${parameters.cssStyle}"<#rt/> > <#if (actionErrors?? && actionErrors?size > 0)> <#list actionErrors as error> <#if error??> -
  • <#if parameters.escape>${error!?html}<#else>${error!}<#rt/>
    • <#rt/> +
  • <#if parameters.escape>${error!}<#else>${error!}<#rt/>
    • <#rt/> diff --git a/apps/showcase/src/main/resources/template/ajaxErrorContainers/controlfooter.ftl b/apps/showcase/src/main/resources/template/ajaxErrorContainers/controlfooter.ftl index 5d27b6f78..588b400c0 100644 --- a/apps/showcase/src/main/resources/template/ajaxErrorContainers/controlfooter.ftl +++ b/apps/showcase/src/main/resources/template/ajaxErrorContainers/controlfooter.ftl @@ -28,7 +28,7 @@ ${parameters.after!}<#t/> <#rt/> <#if hasFieldErrors> <#list fieldErrors[parameters.name] as error> -
    ${error?html}
    <#t/> +
    ${error}
    <#t/> <#lt/> diff --git a/apps/showcase/src/main/resources/template/ajaxErrorContainers/controlheader-core.ftl b/apps/showcase/src/main/resources/template/ajaxErrorContainers/controlheader-core.ftl index fe0b96c2c..4ea2e6db5 100644 --- a/apps/showcase/src/main/resources/template/ajaxErrorContainers/controlheader-core.ftl +++ b/apps/showcase/src/main/resources/template/ajaxErrorContainers/controlheader-core.ftl @@ -27,7 +27,7 @@ <#rt/> <#if hasFieldErrors> <#list fieldErrors[parameters.name] as error> -
    ${error?html}
    <#t/> +
    ${error}
    <#t/> <#lt/> @@ -51,7 +51,7 @@ <#if parameters.label??> <#t/> diff --git a/apps/showcase/src/main/webapp/WEB-INF/person/list-people.ftl b/apps/showcase/src/main/webapp/WEB-INF/person/list-people.ftl index abb2ae449..88ededf7c 100644 --- a/apps/showcase/src/main/webapp/WEB-INF/person/list-people.ftl +++ b/apps/showcase/src/main/webapp/WEB-INF/person/list-people.ftl @@ -51,9 +51,9 @@ <#list people as person> - ${person.id?html} - ${person.name?html} - ${person.lastName?html} + ${person.id} + ${person.name} + ${person.lastName} diff --git a/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/actionPrefix.ftl b/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/actionPrefix.ftl index e546632a9..6e4432ea5 100644 --- a/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/actionPrefix.ftl +++ b/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/actionPrefix.ftl @@ -33,7 +33,7 @@

    You have come to this page because you used an action prefix.

    -

    The text you've entered is ${text!''?html}

    +

    The text you've entered is ${text!''}

    <@s.a href="javascript:history.back();" cssClass="btn btn-info"> Back diff --git a/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/methodPrefix.ftl b/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/methodPrefix.ftl index b4d723aa0..e1460408e 100644 --- a/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/methodPrefix.ftl +++ b/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/methodPrefix.ftl @@ -33,7 +33,7 @@

    You have come to this page because you used an method prefix.

    -

    The text you've enter is ${text!''?html}

    +

    The text you've enter is ${text!''}

    <@s.a href="javascript:history.back();" cssClass="btn btn-info"> Back diff --git a/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/redirectActionPrefix.ftl b/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/redirectActionPrefix.ftl index ed06fb595..481ad9724 100644 --- a/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/redirectActionPrefix.ftl +++ b/apps/showcase/src/main/webapp/WEB-INF/tags/non-ui/actionPrefix/redirectActionPrefix.ftl @@ -36,7 +36,7 @@

    Because this is a redirect-action, the text will be lost, due to a redirection implies a new request being issued from the client.

    - The text you've enter is ${text!''?html}

    + The text you've enter is ${text!''}

    <@s.a href="javascript:history.back();" cssClass="btn btn-info"> Back diff --git a/core/src/main/java/org/apache/struts2/components/UIBean.java b/core/src/main/java/org/apache/struts2/components/UIBean.java index b7c4432e4..0e44a3b74 100644 --- a/core/src/main/java/org/apache/struts2/components/UIBean.java +++ b/core/src/main/java/org/apache/struts2/components/UIBean.java @@ -887,7 +887,7 @@ public abstract class UIBean extends Component { protected String escape(String name) { // escape any possible values that can make the ID painful to work with in JavaScript if (name != null) { - return name.replaceAll("[\\/\\.\\[\\]]", "_"); + return name.replaceAll("[\\/\\.\\[\\]\'\"]", "_"); } else { return null; } @@ -1002,7 +1002,7 @@ public abstract class UIBean extends Component { } else { tryId = generatedId; } - + //fix for https://issues.apache.org/jira/browse/WW-4299 //do not assign value to id if tryId is null if (tryId != null) { diff --git a/core/src/main/java/org/apache/struts2/views/freemarker/FreemarkerManager.java b/core/src/main/java/org/apache/struts2/views/freemarker/FreemarkerManager.java index cb3b4ce08..7f72d0b1f 100644 --- a/core/src/main/java/org/apache/struts2/views/freemarker/FreemarkerManager.java +++ b/core/src/main/java/org/apache/struts2/views/freemarker/FreemarkerManager.java @@ -25,6 +25,8 @@ import com.opensymphony.xwork2.inject.Inject; import com.opensymphony.xwork2.util.ClassLoaderUtil; import com.opensymphony.xwork2.util.ValueStack; import freemarker.cache.*; +import freemarker.core.HTMLOutputFormat; +import freemarker.core.OutputFormat; import freemarker.core.TemplateClassResolver; import freemarker.ext.jsp.TaglibFactory; import freemarker.ext.servlet.HttpRequestHashModel; @@ -334,6 +336,9 @@ public class FreemarkerManager { configuration.setWhitespaceStripping(true); LOG.debug("Sets NewBuiltinClassResolver to TemplateClassResolver.SAFER_RESOLVER"); configuration.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER); + LOG.debug("Sets HTML as an output format and escaping policy"); + configuration.setAutoEscapingPolicy(Configuration.ENABLE_IF_DEFAULT_AUTO_ESCAPING_POLICY); + configuration.setOutputFormat(HTMLOutputFormat.INSTANCE); return configuration; } diff --git a/core/src/main/resources/org/apache/struts2/dispatcher/error.ftl b/core/src/main/resources/org/apache/struts2/dispatcher/error.ftl index 2153bdaed..89d6a8958 100644 --- a/core/src/main/resources/org/apache/struts2/dispatcher/error.ftl +++ b/core/src/main/resources/org/apache/struts2/dispatcher/error.ftl @@ -63,17 +63,17 @@

      <#list msgs as msg> <#if (msg?is_method)> -
    1. ${msg[0]?html}
      2. +
    2. ${msg[0]}
      3. <#else> -
    3. ${msg?html}
      4. +
    4. ${msg}
    <#elseif (msgs?size == 1)> <#if (msgs[0]?is_method)> -
  • ${msgs[0][0]?html}
    • +
  • ${msgs[0][0]}
    • <#else> -
  • ${msgs[0]?html}
    • +
  • ${msgs[0]}
    • @@ -107,12 +107,12 @@ <#list snippet as line> <#if (line_index == 2)> <#if (rootloc.columnNumber >= 3)> - 
    ${(line[0..(rootloc.columnNumber-3)]?html)}${(line[(rootloc.columnNumber-2)]?html)}<#if ((rootloc.columnNumber)${(line[(rootloc.columnNumber-1)..]?html)}
    + 
    ${(line[0..(rootloc.columnNumber-3)])}${(line[(rootloc.columnNumber-2)])}<#if ((rootloc.columnNumber)${(line[(rootloc.columnNumber-1)..])}
    <#else> - 
    ${line?html}
    + 
    ${line}
    <#else> - 
    ${line?html}
    + 
    ${line}
    @@ -124,11 +124,11 @@

    Stacktraces

    <#list chain as ex>
    - ${ex?html} + ${ex} 
         <#list ex.stackTrace as frame>
-    ${frame?html}
+    ${frame}
    diff --git a/core/src/main/resources/template/css_xhtml/checkbox.ftl b/core/src/main/resources/template/css_xhtml/checkbox.ftl index 5bb7eb20c..fc2b0c58c 100644 --- a/core/src/main/resources/template/css_xhtml/checkbox.ftl +++ b/core/src/main/resources/template/css_xhtml/checkbox.ftl @@ -34,7 +34,7 @@ lables errorFor="${parameters.id}"<#rt/> class="errorMessage"> - ${error?html} + ${error}
    <#t/> <#t/> @@ -49,14 +49,14 @@ lables <#if parameters.id??>id="wwlbl_${parameters.id}"<#rt/> class="wwlbl"> <#if parameters.id??> - for="${parameters.id?html}"<#rt/> + for="${parameters.id}"<#rt/> <#if hasFieldErrors> class="checkboxErrorLabel"<#rt/> <#else> class="label"<#rt/> ->${parameters.label?html}<#rt/> +>${parameters.label}<#rt/> @@ -87,14 +87,14 @@ lables <#if parameters.id??>id="wwlbl_${parameters.id}"<#rt/> class="wwlbl"> <#if parameters.id??> - for="${parameters.id?html}"<#rt/> + for="${parameters.id}"<#rt/> <#if hasFieldErrors> class="checkboxErrorLabel"<#rt/> <#else> class="checkboxLabel"<#rt/> ->${parameters.label?html}<#rt/> +>${parameters.label}<#rt/> <#if parameters.label??> diff --git a/core/src/main/resources/template/css_xhtml/controlfooter.ftl b/core/src/main/resources/template/css_xhtml/controlfooter.ftl index c4b06b6fb..d90fa7b55 100644 --- a/core/src/main/resources/template/css_xhtml/controlfooter.ftl +++ b/core/src/main/resources/template/css_xhtml/controlfooter.ftl @@ -40,7 +40,7 @@ ${parameters.after!}<#t/> errorFor="${parameters.id}"<#rt/> class="errorMessage"> - ${error?html} + ${error} <#t/> <#t/> diff --git a/core/src/main/resources/template/css_xhtml/controlheader-core.ftl b/core/src/main/resources/template/css_xhtml/controlheader-core.ftl index 028957fd4..d7aacf602 100644 --- a/core/src/main/resources/template/css_xhtml/controlheader-core.ftl +++ b/core/src/main/resources/template/css_xhtml/controlheader-core.ftl @@ -34,7 +34,7 @@ errorFor="${parameters.id}"<#rt/> class="errorMessage"> - ${error?html} + ${error} <#t/> <#t/> @@ -55,7 +55,7 @@ <#if parameters.id??>id="wwlbl_${parameters.id}"<#rt/> class="wwlbl"> <#t/> <#if (labelpos!"top") == 'top'> diff --git a/core/src/main/resources/template/css_xhtml/label.ftl b/core/src/main/resources/template/css_xhtml/label.ftl index 2a2624cfc..03c6a6192 100644 --- a/core/src/main/resources/template/css_xhtml/label.ftl +++ b/core/src/main/resources/template/css_xhtml/label.ftl @@ -22,19 +22,19 @@ <#include "/${parameters.templateDir}/${parameters.expandTheme}/controlheader.ftl" /> <#if parameters.id??> - id="${parameters.id?html}"<#rt/> + id="${parameters.id}"<#rt/> <#if parameters.cssClass??> - class="${parameters.cssClass?html}"<#rt/> + class="${parameters.cssClass}"<#rt/> <#if parameters.cssStyle??> - style="${parameters.cssStyle?html}"<#rt/> + style="${parameters.cssStyle}"<#rt/> <#if parameters.cssClass??> - class="${parameters.cssClass?html}"<#rt/> + class="${parameters.cssClass}"<#rt/> <#if parameters.for??> - for="${parameters.for?html}"<#rt/> + for="${parameters.for}"<#rt/> ><#rt/> <#if parameters.nameValue??> diff --git a/core/src/main/resources/template/simple/a-close.ftl b/core/src/main/resources/template/simple/a-close.ftl index 78b319c48..fb532f49e 100644 --- a/core/src/main/resources/template/simple/a-close.ftl +++ b/core/src/main/resources/template/simple/a-close.ftl @@ -20,22 +20,22 @@ --> <#if parameters.id??> - id="${parameters.id?html}"<#rt/> + id="${parameters.id}"<#rt/> <#if parameters.href??> - href="${parameters.href}"<#rt/> + href="${parameters.href?no_esc}"<#rt/> <#if parameters.tabindex??> - tabindex="${parameters.tabindex?html}"<#rt/> + tabindex="${parameters.tabindex}"<#rt/> <#if parameters.cssClass??> - class="${parameters.cssClass?html}"<#rt/> + class="${parameters.cssClass}"<#rt/> <#if parameters.cssStyle??> - style="${parameters.cssStyle?html}"<#rt/> + style="${parameters.cssStyle}"<#rt/> <#if parameters.title??> - title="${parameters.title?html}"<#rt/> + title="${parameters.title}"<#rt/> <#include "/${parameters.templateDir}/${parameters.expandTheme}/scripting-events.ftl" /> <#include "/${parameters.templateDir}/${parameters.expandTheme}/common-attributes.ftl" /> diff --git a/core/src/main/resources/template/simple/actionerror.ftl b/core/src/main/resources/template/simple/actionerror.ftl index 16a9a4750..37e1a2e85 100644 --- a/core/src/main/resources/template/simple/actionerror.ftl +++ b/core/src/main/resources/template/simple/actionerror.ftl @@ -21,20 +21,20 @@ <#if (actionErrors?? && actionErrors?size > 0)> <#if parameters.id??> - id="${parameters.id?html}"<#rt/> + id="${parameters.id}"<#rt/> <#if parameters.cssClass??> - class="${parameters.cssClass?html}"<#rt/> + class="${parameters.cssClass}"<#rt/> <#else> class="errorMessage"<#rt/> <#if parameters.cssStyle??> - style="${parameters.cssStyle?html}"<#rt/> + style="${parameters.cssStyle}"<#rt/> > <#list actionErrors as error> <#if error??> -
  • <#if parameters.escape>${error!?html}<#else>${error!}<#rt/>
    • <#rt/> +
  • <#if parameters.escape>${error!}<#else>${error!?no_esc}<#rt/>
    • <#rt/> diff --git a/core/src/main/resources/template/simple/actionmessage.ftl b/core/src/main/resources/template/simple/actionmessage.ftl index 3643654ba..a0f14110d 100644 --- a/core/src/main/resources/template/simple/actionmessage.ftl +++ b/core/src/main/resources/template/simple/actionmessage.ftl @@ -21,20 +21,20 @@ <#if (actionMessages?? && actionMessages?size > 0 && !parameters.isEmptyList)> <#if parameters.id??> - id="${parameters.id?html}"<#rt/> + id="${parameters.id}"<#rt/> <#if parameters.cssClass??> - class="${parameters.cssClass?html}"<#rt/> + class="${parameters.cssClass}"<#rt/> <#else> class="actionMessage"<#rt/> <#if parameters.cssStyle??> - style="${parameters.cssStyle?html}"<#rt/> + style="${parameters.cssStyle}"<#rt/> > <#list actionMessages as message> <#if message??> -
  • <#if parameters.escape>${message!?html}<#else>${message!}
    • +
  • <#if parameters.escape>${message!}<#else>${message!?no_esc}
    • diff --git a/core/src/main/resources/template/simple/checkbox.ftl b/core/src/main/resources/template/simple/checkbox.ftl index 9be833775..54507d90a 100644 --- a/core/src/main/resources/template/simple/checkbox.ftl +++ b/core/src/main/resources/template/simple/checkbox.ftl @@ -18,7 +18,7 @@ * under the License. */ --> - + <#if parameters.nameValue?? && parameters.nameValue> checked="checked"<#rt/> @@ -26,21 +26,21 @@ disabled="disabled"<#rt/> <#if parameters.tabindex?has_content> - tabindex="${parameters.tabindex?html}"<#rt/> + tabindex="${parameters.tabindex}"<#rt/> <#if parameters.id?has_content> - id="${parameters.id?html}"<#rt/> + id="${parameters.id}"<#rt/> <#include "/${parameters.templateDir}/${parameters.expandTheme}/css.ftl" /> <#if parameters.title?has_content> - title="${parameters.title?html}"<#rt/> + title="${parameters.title}"<#rt/> <#include "/${parameters.templateDir}/${parameters.expandTheme}/scripting-events.ftl" /> <#include "/${parameters.templateDir}/${parameters.expandTheme}/common-attributes.ftl" /> <#include "/${parameters.templateDir}/${parameters.expandTheme}/dynamic-attributes.ftl" /> /> <#if parameters.submitUnchecked!false> - + <#if parameters.disabled!false> disabled="disabled"<#rt/> diff --git a/core/src/main/resources/template/simple/checkboxlist.ftl b/core/src/main/resources/template/simple/checkboxlist.ftl index 0018b811b..3fa27f189 100644 --- a/core/src/main/resources/template/simple/checkboxlist.ftl +++ b/core/src/main/resources/template/simple/checkboxlist.ftl @@ -59,11 +59,11 @@ <#assign itemTitle = ''/> - + <#if parameters.id?has_content> - id="${parameters.id?html}-${itemCount}"<#rt/> + id="${parameters.id}-${itemCount}"<#rt/> <#else> - id="${parameters.name?html}-${itemCount}"<#rt/> + id="${parameters.name}-${itemCount}"<#rt/> <#if tag.contains(parameters.nameValue, itemKey)> checked="checked"<#rt/> @@ -72,24 +72,24 @@ disabled="disabled"<#rt/> <#if itemCssClass??> - class="${itemCssClass?html}"<#rt/> + class="${itemCssClass}"<#rt/> <#else> <#if parameters.cssClass?has_content> - class="${parameters.cssClass?html}"<#rt/> + class="${parameters.cssClass}"<#rt/> <#if itemCssStyle??> - style="${itemCssStyle?html}"<#rt/> + style="${itemCssStyle}"<#rt/> <#else> <#if parameters.cssStyle?has_content> - style="${parameters.cssStyle?html}"<#rt/> + style="${parameters.cssStyle}"<#rt/> <#if itemTitle??> - title="${itemTitle?html}"<#rt/> + title="${itemTitle}"<#rt/> <#else> <#if parameters.title?has_content> - title="${parameters.title?html}"<#rt/> + title="${parameters.title}"<#rt/> <#include "/${parameters.templateDir}/${parameters.expandTheme}/css.ftl" /> @@ -99,16 +99,16 @@ /> <#if parameters.id?has_content> - for="${parameters.id?html}-${itemCount}"<#rt/> + for="${parameters.id}-${itemCount}"<#rt/> <#else> - for="${parameters.name?html}-${itemCount}"<#rt/> + for="${parameters.name}-${itemCount}"<#rt/> - class="checkboxLabel">${itemValue?html} + class="checkboxLabel">${itemValue} <#else>   - <#if parameters.disabled!false> disabled="disabled"<#rt/> diff --git a/core/src/main/resources/template/simple/combobox.ftl b/core/src/main/resources/template/simple/combobox.ftl index 3d953c5e3..1a6d80504 100644 --- a/core/src/main/resources/template/simple/combobox.ftl +++ b/core/src/main/resources/template/simple/combobox.ftl @@ -19,9 +19,9 @@ */ --> <#include "/${parameters.templateDir}/simple/text.ftl" />
    <#if parameters.list??> - <#include "/${parameters.templateDir}/${parameters.expandTheme}/css.ftl" /> <#if parameters.disabled!false> disabled="disabled"<#rt/> > <#if (parameters.headerKey?? && parameters.headerValue??)> - + <#if parameters.emptyOption!false> @@ -80,21 +80,21 @@ <#assign itemTitle = ''/> - <#lt/> diff --git a/core/src/main/resources/template/simple/common-attributes.ftl b/core/src/main/resources/template/simple/common-attributes.ftl index 9c96fbb1c..d68c0886b 100644 --- a/core/src/main/resources/template/simple/common-attributes.ftl +++ b/core/src/main/resources/template/simple/common-attributes.ftl @@ -19,5 +19,5 @@ */ --> <#if parameters.accesskey?has_content> - accesskey="${parameters.accesskey?html}" + accesskey="${parameters.accesskey}" \ No newline at end of file diff --git a/core/src/main/resources/template/simple/css.ftl b/core/src/main/resources/template/simple/css.ftl index f1f07b64f..9980c737b 100644 --- a/core/src/main/resources/template/simple/css.ftl +++ b/core/src/main/resources/template/simple/css.ftl @@ -20,14 +20,14 @@ --> <#assign hasFieldErrors = parameters.name?? && fieldErrors?? && fieldErrors[parameters.name]??/> <#if parameters.cssClass?has_content && !(hasFieldErrors && parameters.cssErrorClass??)> - class="${parameters.cssClass?html}"<#rt/> + class="${parameters.cssClass}"<#rt/> <#elseif parameters.cssClass?has_content && (hasFieldErrors && parameters.cssErrorClass??)> - class="${parameters.cssClass?html} ${parameters.cssErrorClass?html}"<#rt/> + class="${parameters.cssClass} ${parameters.cssErrorClass}"<#rt/> <#elseif !(parameters.cssClass?has_content) && (hasFieldErrors && parameters.cssErrorClass??)> - class="${parameters.cssErrorClass?html}"<#rt/> + class="${parameters.cssErrorClass}"<#rt/> <#if parameters.cssStyle?has_content && !(hasFieldErrors && (parameters.cssErrorStyle?? || parameters.cssErrorClass??))> - style="${parameters.cssStyle?html}"<#rt/> + style="${parameters.cssStyle}"<#rt/> <#elseif hasFieldErrors && parameters.cssErrorStyle??> - style="${parameters.cssErrorStyle?html}"<#rt/> + style="${parameters.cssErrorStyle}"<#rt/> \ No newline at end of file diff --git a/core/src/main/resources/template/simple/debug.ftl b/core/src/main/resources/template/simple/debug.ftl index c331d50fe..7f007a78f 100644 --- a/core/src/main/resources/template/simple/debug.ftl +++ b/core/src/main/resources/template/simple/debug.ftl @@ -42,8 +42,8 @@
    -[Debug] -