KocsisDaniel/liferay-portal — pull request #208 by vilmospapp (2013-01-02 15:42:09+00:00)
Title: [TECHNICAL SUPPORT] LPS-32031 Fixed XSS issue in Related Asset Selection

Hi Dani,

I reviewed this issue based on your notes about escaping in the taglibs, but I guess in this case it's cannot be done.

In some portlets we pass label in the form of : LanguageUtil.format(pageContext, "entries-with-tag-x", HtmlUtil.escape(tagName))

and
HtmlUtil.escapeAttribute( LanguageUtil.format(pageContext, "entries-with-tag-x", tagName)) what would be the executed code after moving the escape functionality to the option tag wouldn't give the same result as the above line based on the http://www.liferay.com/community/wiki/-/wiki/Main/Escaping
in Pattern 1 LanguageUtil section's infromation.

Regards,
Vilmos