Project

General

Profile

Actions
Copy link

Feature #56642

closed

Missing TypoScript property to quote and escape content for use in JavaScript

Added by Jigal van Hemert about 10 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Should have
Assignee:
Jigal van Hemert
Category:
TypoScript
Target version:
-
Start date:
2014-03-20
Due date:
% Done:

100%

Estimated time:
(Total: 0.00 h)
PHP Version:
Tags:
Complexity:
easy
Sprint Focus:

Description

We have htmlSpecialChars and rawUrlEncode in stdWrap, but no equivalent of \TYPO3\CMS\Core\Utility\GeneralUtility::quoteJSvalue()

Subtasks 1 (0 open — 1 closed)

Task #57107: Rename escapeJsValue and make it context specificClosedJigal van Hemert2014-03-20

Actions
Actions
Copy link
 #1

Updated by Jigal van Hemert about 10 years ago

Use case: JavaScript for a statistics tools needs to log some of the submitted data or one of the URL parameters. It's easy to build some TS that puts that data in a block of JS, but without proper escaping (and possibly quoting) a visitor can create XSS.

Actions
Copy link
 #2

Updated by Jigal van Hemert about 10 years ago

  • Assignee set to Jigal van Hemert

RM was asked and doesn't mind having it in 6.2LTS.

Actions
Copy link
 #3

Updated by Gerrit Code Review about 10 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/28177

Actions
Copy link
 #4

Updated by Gerrit Code Review about 10 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/28177

Actions
Copy link
 #5

Updated by Jigal van Hemert about 10 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions
Copy link
 #6

Updated by Benni Mack over 5 years ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF