0 Replies Latest reply on Feb 20, 2009 5:16 AM by Marcus Ford

    rich:PickList, s:selectItems and Converter problem

    Marcus Ford Newbie

      Hi All,


      I have a problem with a rich:pickList rendering s:selectItems unescaped. The values being displayed in my pickList are grabbed from the DB, where they were first entered by the user - so it is possible that a user may have put something nasty like '<script>alert('badness')<\script>' in there.


      I've noticed that the default setting for s:selectItems is to automatically escape any selectItem object it generates (i.e escape=true), so I'm unsure why my values are being displayed unescaped.


      I am also using a converter for my pickList, however the value it returns from getAsString() is always escaped.


      Here is the code for my rich:pickList:


      <rich:pickList
        id="aPickList"
        value="#{pickList.groups}"
        converter="#{aConverter}"
        valueChangeListener="#{pickList.selectionChanged}"
        copyControlLabel="Select"
        copyAllControlLabel="Select All"
        removeControlLabel="Restore"
        removeAllControlLabel="Restore All">                              
        <s:selectItems value="#{groups}" var="group" label="#{group.name}" />
      </rich:pickList>
      



      It'd be great if you could let me know either what I'm doing wrong, or if this is a common problem with the pickList tag. I'm using seam 2.1.1.GA, on JBoss 4.2.3.GA.


      I think I've covered everything relevant, let me know if you need more info.


      Regards, Marcus