HttpServletRequest XML string parameter loses HTML Entities in POST action

Question

I have an issue reading an XML string parameter from the request body.

Giving the following HTML:

<!DOCTYPE html>
<html>

<meta http-equiv="Content-Type" content="text/html;charset=UTF-8">

<body>

<form action="http://localhost:8080/action" method="post">
  <input type="hidden" name="TEST" value="<test>mytest</test>"/>    
  <input type="submit" value="Submit">
</form>

</body>
</html>

And the following @PostMapping action:

@PostMapping
public void action(HttpServletRequest request, HttpServletResponse response) throws Exception {
    String context = request.getParameter("TEST");
    System.out.println(context);
}

In the ouput console I have mytest instead of <test>mytest</test>

The String is losing its Html entities.

What's missing?

Try escaping https://stackoverflow.com/questions/7381974/which-characters-need-to-be-escaped-in-html — seenukarthi, Feb 03 '20 at 11:28
I have tried with value="<test>mytest</test>" but I have the same result. — Alessandro C, Feb 03 '20 at 11:46

score 0 · Answer 1 · answered Feb 04 '20 at 14:06

0

I had a Jsoup dependency that was the cause of the issue. Jsoup removes every tag that's not defined in a proper Whitelist.

answered Feb 04 '20 at 14:06

Alessandro C

3,310
9
46
82

HttpServletRequest XML string parameter loses HTML Entities in POST action

1 Answers1