From 2303b9a5a65f3e5a32d81ae0691dd17a5d3b66ca Mon Sep 17 00:00:00 2001
From: jameskleeh <james.kleeh@gmail.com>
Date: Thu, 20 Oct 2016 19:55:58 -0400
Subject: [PATCH] Encode as html select option values

---
 .../org/grails/plugins/web/taglib/FormTagLib.groovy       | 2 +-
 .../groovy/org/grails/web/taglib/SelectTagTests.groovy    | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/grails-plugin-gsp/src/main/groovy/org/grails/plugins/web/taglib/FormTagLib.groovy b/grails-plugin-gsp/src/main/groovy/org/grails/plugins/web/taglib/FormTagLib.groovy
index dda33de4530..a32f75f53a0 100644
--- a/grails-plugin-gsp/src/main/groovy/org/grails/plugins/web/taglib/FormTagLib.groovy
+++ b/grails-plugin-gsp/src/main/groovy/org/grails/plugins/web/taglib/FormTagLib.groovy
@@ -1069,7 +1069,7 @@ class FormTagLib implements ApplicationContextAware, InitializingBean, TagLibrar
             }
         }
         keyValue = processFormFieldValueIfNecessary(selectName, "${keyValue}","option")
-        writer << "value=\"${keyValue}\" "
+        writer << "value=\"${keyValue.toString().encodeAsHTML()}\" "
         if (selected) {
             writer << 'selected="selected" '
         }
diff --git a/grails-test-suite-web/src/test/groovy/org/grails/web/taglib/SelectTagTests.groovy b/grails-test-suite-web/src/test/groovy/org/grails/web/taglib/SelectTagTests.groovy
index 0b3b7dabd4e..5ade5e22332 100644
--- a/grails-test-suite-web/src/test/groovy/org/grails/web/taglib/SelectTagTests.groovy
+++ b/grails-test-suite-web/src/test/groovy/org/grails/web/taglib/SelectTagTests.groovy
@@ -22,6 +22,14 @@ class SelectTagTests extends AbstractGrailsTagTests {
         assertTrue "should have HTML escaped attributes", result.startsWith('<select id="bar&quot; /&gt;&lt;script&gt;alert(&quot;gotcha&quot;)&lt;/script&gt;.genre" name="bar&quot; /&gt;&lt;script&gt;alert(&quot;gotcha&quot;)&lt;/script&gt;.genre" >')
     }
 
+    void testSelectTagEscapingValue() {
+        def template = '<g:select id="genre" name="genre" from="${values}" />'
+        def result = applyTemplate(template, [values: ["\"></option></select><script>alert('hi')</script>"]])
+
+        println result
+        assertTrue "should have HTML escaped values", result.contains('<option value="&quot;&gt;&lt;/option&gt;&lt;/select&gt;&lt;script&gt;alert(&#39;hi&#39;)&lt;/script&gt;" >&quot;&gt;&lt;/option&gt;&lt;/select&gt;&lt;script&gt;alert(&#39;hi&#39;)&lt;/script&gt;</option>')
+    }
+
     void testSelectUsesExpressionForDisable() {
         def template = '<g:set var="flag" value="${true}"/><g:select disabled="${flag}" name="foo" id="foo" from="[1,2,3]" />'
         assertOutputContains('disabled="disabled"', template)