[#JRA-14384] Project name that contains double-quote is not properly escaped on Issue Navigator page

JIRA

Project name that contains double-quote is not properly escaped on Issue Navigator page

Created: 01/Feb/08 06:29 AM Updated: 04/Feb/08 08:01 PM

Component/s:

Security, Web interface

Affects Version/s:

3.11

Fix Version/s:

3.12.2

Time Tracking:

Original Estimate:

3 hours

Remaining Estimate:

0 minutes

Time Spent:

2 hours, 30 minutes

Participants:	Anton Mazkovoi [Atlassian], Dushan Hanuska [Atlassian] and Igor Sereda
Since last comment:	29 weeks, 4 days ago
Resolution Date:	04/Feb/08 08:01 PM
Labels:

Description

« Hide

If a project has a double-quote in its name, it's not xml-escaped when used in "title" attribute. For example, if we have a project named 14" monitors, the html will look like:

<select name="pid" ....>
<option title="14" monitors" value="10000" >14" monitors</option>

This causes JIRA Client to hiccup on this page and lose a lot of functionality. On web browser, the title is displayed incorrectly.

I can only imagine what would happen if a project contained the following characters: "></html>

All

Comments

Work Log

Change History

Sort Order:

[ Permlink | « Hide ]

Anton Mazkovoi [Atlassian] added a comment - 03/Feb/08 09:52 PM

I can only imagine what would happen if a project contained the following characters: "></html>

Yeah, me too.

Thanks for reporting!