[Seaside] Problem with WAScriptTag content escaping,
when nested into a WAScriptTag
Balázs Kósi
rebmekop at gmail.com
Wed Oct 15 09:23:00 UTC 2008
Hi!
If you try this example:
renderContentOn: html
html div
id: 'x';
with: 'foo'.
html script: (
html element
id: 'x';
update: [ :r | html script: 'alert(1)' ]
Seaside2.8a1-pmm.573 renders this for the script tag:
<script type="text/javascript">
/*<![CDATA[*/$('x').update('<script
type="text/javascript">/*<![CDATA[*/alert(1)/*]]>*/
</script>
')/*]]>*/
It appears in the browser like this:
foo
')/*]]>*/
And you get an "unterminated string literal" javascript error.
Maybe the second paragraph of this:
http://en.wikipedia.org/wiki/CDATA#Uses_of_CDATA_sections is related
to the problem.
Thanks, Balázs
More information about the seaside
mailing list