Struts 6 issue with `escapeAmp`

[boris-petrov]

I updated my Struts version to 6 and struts2-jquery-plugin to 5 (and struts2-bootstrap-plugin to 5 but I don't think that's relevant). I'm having troubles with the escapeAmp functionality. The following code:

<div id="div${id}" class="d-inline-block"></div>
<s:url action="forgottenPassword" var="acUrl" escapeAmp="false">
   <s:param name="email" value="%{email}"></s:param>
   <s:param name="ajax" value="true"></s:param>
</s:url>
<sj:a id="link%{id}" href="%{#acUrl}" targets="div%{id}" 
indicator="loader%{id}"
       parentTheme="bootstrap" button="false" cssClass="btn btn-sm 
btn-outline-primary">
   <span id="loader${id}" class="spin-loader" 
style="display:none"></span> Reset password
</sj:a>

Worked fine in Struts 2.5.30. Upgrading to Struts 6, I noticed first that id="link%{id}" had stopped working - that string was used literally as the id and wasn't working as expected - I believe that's this issue.

But the real problem is escapeAmp doesn't seem to work any more. In the generated JavaScript, I see the following - options_anchor_922437047.hrefparameter = "email=boris%40example.com&ajax=true";. As you see, there is & instead of &. This makes the action on the backend not set the ajax variable correctly. I can't seem to make that work no matter what I try. If I remove var="acUrl", the resulting URL looks correct with or without escapeAmp which I also find strange.

I'm not sure if I'm doing something wrong or something has changed?

Here is a reproduction repo:

https://github.com/boris-petrov/struts-issue

Clone the repo, run ./gradlew appStart, open http://localhost:8080/struts-issue (or whatever the address is - it's printed in the console) and then check the script tag - it contains foo=1&ajax=true. If you modify strutsVersion in build.gradle to be 2.5.30 and rerun the app and check the script - it will be fine - foo=1&ajax=true.

Please let me know if you need anything else.

[Dcosmas]

Hi, the same bugs exists with grid :( (I tried with 5.0.1-SNAPSHOT)

I think in grid-close.ftl we have :

<#if parameters.href??> options_${escapedOptionId}.url = "${parameters.href?string}"; </#if>

instead of :

<#if parameters.href! != ""> options_${escapedOptionId}.url = "<#outputformat "JavaScript">${parameters.href}</#outputformat>"; </#if>

What do you think ?

Thanks again for all your work !

[lukaszlenart]

@Dcosmas I think you are right, see #317

[Dcosmas]

Almost Same problem with action.ftl line 31, "" are missing.

[lukaszlenart]

@Dcosmas done