Tag 500 should write problematic lines with escapeHtml

Bug #485946 reported by tomas
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
play framework
Status tracked in 1.0
1.0
Fix Released
Undecided
Unassigned
1.1
Fix Committed
Undecided
Unassigned

Bug Description

Hi, when getting error 500 in DEV, I can see the problematic lines directly in the browser. However, if they contain HTML, it gets written directly to the page. This can be fixed in file templates/tags/500.html, line 105:
<pre>&nbsp;${line.escapeHtml()}</pre>
Also, this same bug is in templates/errors/500.txt but I don't know how that file is used

I am testing with 1.0-r694

Revision history for this message
Guillaume Bort (guillaume-bort) wrote :

It is already fixed with the new auto-escape in HTML templates.

Changed in play:
status: New → Won't Fix
Revision history for this message
tomas (gugljafa) wrote :

This is still a problem if one decides to not use the automatic html escaping

Changed in play:
status: Won't Fix → Incomplete
Changed in play:
status: Incomplete → Fix Committed
Revision history for this message
Guillaume Bort (guillaume-bort) wrote :

Ok we can't fix it this way:

For instance:

--------------------------------------------
package controllers;

import play.mvc.*;

public class Application extends Controller {

 public static void index() {
   render("not_exist_template.html");
 }
}

------------------------------
Template Not Found:
9 render(&quot;not_exist_template.html&quot;);

--------
i changed the 500.html's
<pre>&nbsp;${line.escapeHtml()}</pre>
line to:
<pre>&nbsp;${line.raw()}</pre>

Changed in play:
status: Fix Committed → Incomplete
Changed in play:
status: Incomplete → Fix Committed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.