Export to GitHub

owasp-esapi-js - issue #20

encodeForHTMLAttribute does not encode space character


Posted on Jul 23, 2015 by Happy Ox

$ESAPI.encoder().encodeForHTMLAttribute(' ') should return   as space character is not in present in IMMUNE_HTMLATTR

This could cause breakage in HTML Attribute

Ex: document.getElementByID("test").innerHTML="<div data="+$ESAPI.encoder().encodeForHTMLAttribute('test xyz')+">This is a test</div>";

Would result in the following HMTL content

<div data="test" xyz="">This is a test</div>

Status: New

Labels:
Type-Defect Priority-Medium