Skip to content

Safe output for attributes #142

Description

@shimikano

In the spirit of #55, shouldn't attribute names and values also be properly escaped to prevent XSS attacks?

It seems the fix could be as simple as using HtmlEscapers.htmlEscaper().escape(...) in addAttribute().

Similar to the existing TestEscapeText, a test for this could look something like:

public class TestEscapeForAttributes {

    @Test
    public void testEscapeForAttributeValues() {
        var expected = """
            <!DOCTYPE html>
            <html>
            \t<head>
            \t\t<meta name="foo" content="&quot;&gt;&lt;script&gt;alert(&#39;1&#39;)&lt;/script&gt;">
            \t</head>
            \t<body bar="&quot;&gt;&lt;script&gt;alert(&#39;1&#39;)&lt;/script&gt;">
            \t</body>
            </html>""";

        var view = HtmlFlow.<String>view(page -> page
            .html()
                .head()
                .<String>dynamic((head, text) -> head
                    .meta()
                        .attrName("foo").attrContent(text)
                    .__()
                )
                .__()
                .body()
                    .<String>dynamic((body, text) -> body
                        .addAttr("bar", text)
                    )
                .__()
            .__()
        );

        var html = view.render("\"><script>alert('1')</script>");

        assertEquals(expected, html);
    }

    @Test
    public void testEscapeForAttributeNames() {
        // similarly for attribute names
    }
    
} 

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions