Posted on Jul 23, 2015 by
Happy Ox
$ESAPI.encoder().encodeForHTMLAttribute(' ') should return   as space character is not in present in IMMUNE_HTMLATTR
This could cause breakage in HTML Attribute
Ex: document.getElementByID("test").innerHTML="<div data="+$ESAPI.encoder().encodeForHTMLAttribute('test xyz')+">This is a test</div>";
Would result in the following HMTL content
<div data="test" xyz="">This is a test</div>
Status: New
Labels:
Type-Defect
Priority-Medium