Later Steps to Reproduce
1. run the zul
Current Result
the js script gets executed
Expected Result
the js script doesn't get executed
Debug Information
- according to https://www.zkoss.org/wiki/ZK_Developer%27s_Reference/Security_Tips/Cross-site_scripting#What_ZK_Encodes, ZK should also encode this attribute like other components do, e.g. chosenbox emptyMessage is encoded.
- relates to
-
ZK-5182 Prevent XSS issue in component attributes
-
- Closed
-