JSF SelectItems and escaping (xss)

Question

there is a selectOneMenu in my example with a f:selectItems-attribute. The select-items are resolved from my bean like this:

<h:selectOneMenu value="#{bean.value}">
    <f:selectItems value="#{bean.selectItems}" var="obj" itemValue="#{obj}" itemLabel="#{obj.name}"/>
</h:selectOneMenu>

The method getSelectItems() in my bean looks like that:

    public List<MyObject> getSelectItems() {
        List<MyObject> list = new LinkedList<MyObject>();

        MyObject obj = new MyObject("Peter");
        list.add(obj);

        return list;
    }

The objects that are displayed are simple objects with a attribute "name".

Nothing special up to this point. But now i change my method to that:

 public List<MyObject> getSelectItems() {
        List<MyObject> list = new LinkedList<MyObject>();

        MyObject obj = new MyObject("<script>alert('xss is bad');</script>");
        list.add(obj);

        return list;
    }

The javascript doesn´t get escaped by MenuRenderer-Class and my page shows me the alert-message.

Is there any cause why the default value of the escape-attribute of SelectItem is "false"? How can i fix that problem? (I use Mojarra 2.1.7)

You can find your answer [here](http://stackoverflow.com/questions/14238646/how-to-escape-fselectitem-itemlabel-attribute) — Vikas V, Feb 22 '13 at 09:51
@VikasV: OP's concrete problem concerns the other way round. — BalusC, Feb 22 '13 at 11:49

score 12 · Accepted Answer · answered Feb 22 '13 at 11:55

12

The default should indeed not have been false. I've reported it as issue 2747.

In the meanwhile, add itemLabelEscaped="true" to escape it anyway.

<f:selectItems ... itemLabelEscaped="true" />

Note that this is only necessary when you're using GenericObjectSelectItems, i.e. when you're supplying a E[]/List<E>/Map<K, V> instead of List<SelectItem>/SelectItem[]. Also note that escaping is only absolutely mandatory when it concerns user-controlled input (which is fortunately very rarely the case in dropdown values).

answered Feb 22 '13 at 11:55

BalusC

1,082,665
372
3,610
3,555

This has been fixed in JSF 2.2 ([JAVASERVERFACES_SPEC_PUBLIC-1167](https://java.net/jira/browse/JAVASERVERFACES_SPEC_PUBLIC-1167)) and Mojarra 2.2.6 ([JAVASERVERFACES-3143](https://java.net/jira/browse/JAVASERVERFACES-3143)). – Arend v. Reinersdorff Aug 31 '14 at 08:26

JSF SelectItems and escaping (xss)

1 Answers1

Linked