Re: check response on app

--------------K5dlHaU8RnCgvaBKWCkqqwMf
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Looking into this, basically you cannot use escapeHtml=false and 
escapeJavaScript=true and have <b></b> <strong></strong> <em></em> etc 
work.  There is too much of an overlap between 
what StringEscapeUtils.escapeEcmaScript(result) does trying to escape 
slashes with html slashes (ie you get <b><\/b>, an unterminated <b> 
which messes with the layout).

Guess I will need remove escapeHtml=false.

https://struts.apache.org/tag-developers/property-tag

Maybe there should be a warning on the escapeHtml tag text not to set to 
false without setting escapeJavaScript=true, otherwise it will execute 
the "script" in the response.

On 24/06/2026 07:58, Łukasz Lenart wrote:
> pt., 19 cze 2026 o 08:50 Greg Huber<[email protected]> napisał(a):
>> Error messages can contain <b> or <strong> to highlight input (that my
>> be a typo).
>>
>> We don't want any <script> input to popup ie be executed by the response.
>>
>> escapeJavaScript="false" does not work well.  It messes with the layout.
>>
>> <s:property value="#actionError" escapeHtml="false"
>> escapeJavaScript="false"  />
> So this used to work like this? with no escape and <script/> was
> stripped/escaped automatically?
>
> <s:property value="#actionError"/>
>
>
> Cheers
> Łukasz
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:[email protected]
> For additional commands, e-mail:[email protected]
>
--------------K5dlHaU8RnCgvaBKWCkqqwMf--