[#JAVASERVERFACES-876] h:ouputLink doesn't escape ampersands in URL parameters - Java.net JIRA

javaserverfaces

h:ouputLink doesn't escape ampersands in URL parameters

Created: 07/Dec/08 09:38 PM Updated: 08/Mar/12 03:05 PM Resolved: 11/Dec/08 09:54 AM

Component/s:

implementation

Affects Version/s:

1.2_10

Fix Version/s:

1.2_11-b01

Time Tracking:

Not Specified

File Attachments:	1. changebundle.txt (13 kB) 09/Dec/08 04:04 PM - Ryan Lubke
Environment:	« Hide Operating System: All Platform: All Show » Operating System: All Platform: All

Issuezilla Id:	876
Tags:
Participants:	kennardconsulting, Manfred Riem and Ryan Lubke

Description

« Hide

The following code under Mojarra 1.2_10...

<h:outputLink value="foo">
<f:param name="bar" value="baz"/>
<f:param name="abc" value="def"/>
<h:outputLink value="Foo"/>
</h:outputLink>

...produces this...

...which is invalid HTML. It should be...

...note that the ampersand in the URL should be escaped.

Sort Order:

[ Permalink | « Hide ]

Ryan Lubke added a comment - 08/Dec/08 09:00 AM

It will escape the ampersands in the URL if the response content type is XHTML,
otherwise, it will leave them as is, which is, as far as I can tell, perfectly
acceptable.

[ Permalink | « Hide ]

kennardconsulting added a comment - 08/Dec/08 01:48 PM

Okay, this may be my understanding, but if I go to...

http://validator.w3.org/#validate_by_input

...and enter...

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head><title>Foo</title></head>
<body>
<a href="foo?bar=baz&abc=def">Foo</a>
</body>
</html>

...then I get errors (note the DOCTYPE is HTML, not XHTML). But if I escape the
ampersand then W3C validator is happy.

So this would seem to suggest unescaped ampersands are not valid HTML?

[ Permalink | « Hide ]

Ryan Lubke added a comment - 08/Dec/08 02:18 PM

Well the initial gripe about the unescaped ampersand is a warning.

We can look into changing the renderers to make the validator happy.

As I said, if you want to do that now, use XHTML transitional for your response
content type.

[ Permalink | « Hide ]

kennardconsulting added a comment - 08/Dec/08 02:55 PM

Okay, so how do I set my response content type to XHTML? My JSP page contains
an XHTML DOCTYPE and an XHTML Content-Type meta tag. Do I have to set it on the
HttpResponse itself using a Filter or something?

I tried...

<context-param>
<param-name>com.sun.faces.preferXHTML</param-name>
<param-value>true</param-value>
</context-param>

...but I still get an unescaped ampersand.

[ Permalink | « Hide ]

Ryan Lubke added a comment - 08/Dec/08 03:32 PM

Using JSP you can set the content type by specifying the contentType attribute
on a page directive. Not elegant as you have to do that for every page.

So it sounds like setting the content type in a Filter is probably the easiest
solution.

Just to clarify the 'com.sun.faces.preferXHTML' option. That's there for
processing the accept header. Specifically when HTML and XHTML are weighted the
same. When the config option is true, we'll give preference to XHTML.

[ Permalink | « Hide ]

kennardconsulting added a comment - 08/Dec/08 04:16 PM

Well, given how inelegant it is to work around this problem, could I request
the fix be applied to the 1.2 branch?

Your comment that 'the unescaped ampersand is only a warning' seems a bit
disingenuous. It is invalid HTML, as per the spec:

http://www.w3.org/TR/html401/charset.html#h-5.3.2

...where is says...

"Authors should also use "&" in attribute values since character references
are allowed within CDATA attribute values"

[ Permalink | « Hide ]

Ryan Lubke added a comment - 08/Dec/08 04:36 PM

>Well, given how inelegant it is to work around this problem, could I request
>the fix be applied to the 1.2 branch?

I previously stated that we'd look into it.

>Your comment that 'the unescaped ampersand is only a warning' seems a bit
>disingenuous. It is invalid HTML, as per the spec:

It wasn't at all. The validator said it was a warning. A warning is not an
error.

> http://www.w3.org/TR/html401/charset.html#h-5.3.2
>
>...where is says...
>
>"Authors should also use "&" in attribute values since character
>references are allowed within CDATA attribute values"

'should' is not 'must'.

That said, I think this section is probably more relevant:

http://www.w3.org/TR/html4/appendix/notes.html#ampersands-in-uris

[ Permalink | « Hide ]

kennardconsulting added a comment - 08/Dec/08 04:42 PM

> I previously stated that we'd look into it.

Great, thanks.

> That said, I think this section is probably more relevant

Agreed. And, in fact, in that section it really does say 'must', not 'should':

"For example, to use the URI "http://host/?x=1&y=2" as a linking URI, it must
be written ... <A href="http://host/?x=1&y=2">"

Look forward to your decision regarding 1.2/2.0. Thanks for your time and all
your hard work.