0 Replies Latest reply on Feb 20, 2009 5:16 AM by Marcus Ford

    rich:PickList, s:selectItems and Converter problem

    Marcus Ford Newbie

      Hi All,

      I have a problem with a rich:pickList rendering s:selectItems unescaped. The values being displayed in my pickList are grabbed from the DB, where they were first entered by the user - so it is possible that a user may have put something nasty like '<script>alert('badness')<\script>' in there.

      I've noticed that the default setting for s:selectItems is to automatically escape any selectItem object it generates (i.e escape=true), so I'm unsure why my values are being displayed unescaped.

      I am also using a converter for my pickList, however the value it returns from getAsString() is always escaped.

      Here is the code for my rich:pickList:

        copyAllControlLabel="Select All"
        removeAllControlLabel="Restore All">                              
        <s:selectItems value="#{groups}" var="group" label="#{group.name}" />

      It'd be great if you could let me know either what I'm doing wrong, or if this is a common problem with the pickList tag. I'm using seam 2.1.1.GA, on JBoss 4.2.3.GA.

      I think I've covered everything relevant, let me know if you need more info.

      Regards, Marcus