COLDBOX-237 #resolve

Some HTMLHelper method still need escaping as certain values should never be HTML

Author: lmajano

system/modules/HTMLHelper/models/HTMLHelper.cfc

@@ -118,11 +118,11 @@ component extends="coldbox.system.FrameworkSupertype" accessors=true singleton{
 				// Load Asset
 				if( findNoCase( ".js", item ) ){
 					sb.append(
-						'<script src="#jsPath##item#" #asyncStr##deferStr#></script>'
+						'<script src="#jsPath##encodeForHTMLAttribute( item )#" #asyncStr##deferStr#></script>'
 					);
 				} else {
 					sb.append(
-						'<link href="#cssPath##item#" type="text/css" rel="stylesheet" />'
+						'<link href="#cssPath##encodeForHTMLAttribute( item )#" type="text/css" rel="stylesheet" />'
 					);
 				}
 
@@ -619,15 +619,15 @@ component extends="coldbox.system.FrameworkSupertype" accessors=true singleton{
 		// Add single source
 		if( arrayLen(arguments.src) eq 1){
 			arguments.src[1] = prepareBaseLink(arguments.noBaseURL, arguments.src[1]);
-			video.append(' src="#arguments.src[1]#" />');
+			video.append(' src="#encodeForHTMLAttribute( arguments.src[ 1 ] )#" />');
 			return video.toString();
 		}
 
 		// create source tags
 		video.append(">");
 		for(x=1; x lte arrayLen(arguments.src); x++){
 			arguments.src[ x ] = prepareBaseLink(arguments.noBaseURL, arguments.src[ x ]);
-			video.append('<source src="#arguments.src[ x ]#"/>');
+			video.append('<source src="#encodeForHTMLAttribute( arguments.src[ x ] )#"/>');
 		}
 		video.append("</video>");
 
@@ -684,15 +684,15 @@ component extends="coldbox.system.FrameworkSupertype" accessors=true singleton{
 		// Add single source
 		if( arrayLen(arguments.src) eq 1){
 			arguments.src[1] = prepareBaseLink(arguments.noBaseURL, arguments.src[1]);
-			audio.append(' src="#arguments.src[1]#" />');
+			audio.append(' src="#encodeForHTMLAttribute( arguments.src[1] )#" />');
 			return audio.toString();
 		}
 
 		// create source tags
 		audio.append(">");
 		for(x=1; x lte arrayLen(arguments.src); x++){
 			arguments.src[ x ] = prepareBaseLink(arguments.noBaseURL, arguments.src[ x ]);
-			audio.append('<source src="#arguments.src[ x ]#"/>');
+			audio.append('<source src="#encodeForHTMLAttribute( arguments.src[ x ] )#"/>');
 		}
 		audio.append("</audio>");
 
@@ -964,7 +964,7 @@ component extends="coldbox.system.FrameworkSupertype" accessors=true singleton{
 
 		// create textarea
 		buffer.append("<textarea");
-		flattenAttributes(arguments,"value,label,wrapper,labelWrapper,groupWrapper,labelAttrs,labelClass,bind,bindProperty,inputInsideLabel",buffer).append(">#arguments.value#</textarea>");
+		flattenAttributes(arguments,"value,label,wrapper,labelWrapper,groupWrapper,labelAttrs,labelClass,bind,bindProperty,inputInsideLabel",buffer).append(">#encodeForHTML( arguments.value )#</textarea>");
 
 		//wrapper?
 		wrapTag(buffer,arguments.wrapper,1);