Bug 1636143 - drop down builder doesn't escape angle brackets
Summary: drop down builder doesn't escape angle brackets
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat CloudForms Management Engine
Classification: Red Hat
Component: UI - OPS
Version: 5.9.4
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: GA
: 5.11.0
Assignee: eclarizi
QA Contact: Sudhir Mallamprabhakara
Red Hat CloudForms Documentation
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-10-04 14:37 UTC by Jeff Warnica
Modified: 2019-07-29 18:35 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-11 15:26:06 UTC
Category: ---
Cloudforms Team: CFME Core
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
screenshot (51.92 KB, image/png)
2018-10-04 14:37 UTC, Jeff Warnica
no flags Details

Description Jeff Warnica 2018-10-04 14:37:28 UTC
Created attachment 1490590 [details]
screenshot

I have custom service dialog which has a dynamic drop down element. This pulls in data that includes the quote character.

Appears that the not-actually-a-dropdown UI fails to consider this, and the generate HTML is busted. See the screenshot showing the correct text in the selected element (truncated as it may be), the correct text in the highlighted in the inspector <span>, and the mangled <a> that the <span> lives in.

Comment 2 eclarizi 2018-10-10 20:24:32 UTC
Hey Jeff, can you give me the automate code that is generating this value for your drop-down so I can attempt to reproduce locally?

Comment 3 Jeff Warnica 2018-10-11 15:27:16 UTC
https://github.com/jeffwarnica/rhc-miq-quickstart/blob/master/automate/rhc-miq-quickstart/Service/DynamicDialogs.class/__methods__/list_template_guids.rb is what I was using specifically, but 

dialog_hash[''] = "< No templates found tagged with #{rbac_array} >"

is all you'd need.

Comment 4 Jeff Warnica 2018-10-15 15:53:34 UTC
On reflection, this seems to be not dealing with angle brackets, not quotes.


Note You need to log in before you can comment on or make changes to this bug.