-1

I am using Display tag library and inside one of the columns I got a function which submits to a particular URL. For some it is throwing Unterminated <display:column tag which is pretty straight forward and I do have the closing tag but still it is not working. I got the error for property esignNumDocs. Below is the jsp;

<display:table id="data" name="intgList" requestURI="/integration/viewIntegration" class="fieldLabelCell" pagesize="5">
        <!-- Setting table properties -->
        <display:setProperty name="basic.empty.showtable" value="true"/>
        <display:setProperty name="paging.banner.placement" value="top"/>
        <display:setProperty name="basic.msg.empty_list_row" value=""/>
        <display:setProperty name="paging.banner.group_size" value="2"/>
        <display:setProperty name="paging.banner.no_items_found" value=""/>
        <display:setProperty name="paging.banner.page.separator" value=" of "/>
        <display:setProperty name="paging.banner.first" value='<span class="pagelinks"> |< << | Page {0} <a href="{3}"> | >> </a><a href="{4}">>|</a></span>'/>
        <display:setProperty name="paging.banner.last" value='<span class="pagelinks"> <a href="{1}">|< </a> <a href="{2}"> << | Page </a> {0} | >> >| </span>'/>
        <display:setProperty name="paging.banner.full" value='<span class="pagelinks"> <a href="{1}">|< </a> <a href="{2}"> << | Page </a> {0}<a href="{3}"> | >> </a><a href="{4}">>| </a></span>'/>

        <!-- Displaying columns data -->
        <display:column property="lob" title="Line of<br>Business" sortable="true" class="displayColumns" />
        <display:column property="insuredName" title="Insured" sortable="true"  class="displayColumns"/>
        <display:column property="custPhone" title="Customer<br>Phone" sortable="true"  class="displayColumns" />
        <display:column property="policyNumber" title="Policy #" sortable="true" class="displayColumns" />
        <display:column property="createdDate" title="E-Sign<br>Created Date" sortable="true" class="displayColumns" />
        <display:column property="custEmail" title="Customer<br>Email" sortable="true" class="displayColumns" />
        <display:column property="esignNumDocs" title="# of E-Sign Documents" class="displayColumns" 
            href='#x' onclick="locateFunc('viewESignDetails', {'url':'<integration:urlAction actionName="/integration/viewDetailsIntegration"><integration:urlParam key="esignIdentifier" value="${list.esignId}"/></integration:urlAction>',
                'agencyCode':'${list.agencyCode}',
                'policyNumber':'${list.policyNumber}',
                'policyState':'${list.policyState}',
                'esignIdentifier':'${list.esignId}',
                'esignVendorIdentifier':'${list.esignVendorIdentifier}',
                'lob':'${list.lob}',
                'transId':'${list.transId}',
                'customerName':'${list.insuredName}',
                'customerPhone':'${list.custPhone}',
                'customerEmail':'${list.custEmail}',
                'cretedDate':'${list.createdDate}'}>)"
                <c:out value="${list.esignNumDocs}"/>
        </display:column>
    </display:table>

Any help is appreciated.

Thanks

Mike
  • 777
  • 3
  • 16
  • 41
  • The color-coding of the question XML should be a hint to you of the problem. The `onclick` attribute is double-quoted, and contains unescaped double-quotes. It is **bad XML**. You have to encode `<`, `&`, and `"` characters in the attribute with `<`, `&`, and `"`. The parser may be lenient on `<` inside attribute values, but they are not valid in XML 1.0. See https://www.w3.org/TR/2008/REC-xml-20081126/#NT-AttValue – Andreas May 17 '17 at 17:25
  • I am not getting you. onclick function is already in double quotes. – Mike May 17 '17 at 17:29
  • `onclick="locateFunc(` ... `actionName="/integration/` ... The `"` after `actionName` *ends* the `onclick` attrubute prematurely. To fix, change to `actionName="/integration/`, as well as all the other embedded `"` characters in the attribute. --- I can't even find where *you* think the `onclick` attribute ends. I think the end of the `display:column` tag is near `createdDate}'}>)"`, but that `>` is misplaced and should be `createdDate}'})">` --- In short, **bad XML**. Multiple errors. – Andreas May 17 '17 at 17:36
  • And I hope for your sake, that none of the `${list.XXX}` values can contain `&`, `'`, or `"` characters, because that would corrupt the result, given that you don't encode any of it. Your code is susceptible to **HTML Injection (XSS) attacks**. Best case is that page will simply fail. Worst case is that you're **hacked**. – Andreas May 17 '17 at 17:41

1 Answers1

0

This is how you would do it. 

<display:column class="displayColumns" property="esignNumDocs" title="# of E-Sign Documents"
            href="javascript:locateFunc('viewESignDetails', '<integration:urlAction actionName=&quot/integration/viewDetailsIntegration&quot;/><integration:urlParam key=&quot;esignIdentifier&quot; value=&quot;${list.esignId}&quot/></integration:urlAction>', 
                'agencyCode':'${list.agencyCode}',
                'policyNumber':'${list.policyNumber}',
                'policyState':'${list.policyState}',
                'esignIdentifier':'${list.esignId}',
                'esignVendorIdentifier':'${list.esignVendorIdentifier}',
                'lob':'${list.lob}',
                'transId':'${list.transId}',
                'customerName':'${list.insuredName}',
                'customerPhone':'${list.custPhone}',
                'customerEmail':'${list.custEmail}',
                'cretedDate':'${list.createdDate}'}>)&quot;
            );">
        </display:column>