HTML tags in annotation values are not escaped

[Nicklas Nordborg]

Keith Ching wrote:

it seems you can make a String annotation type and attach it to raw bioassay and fill it with

<a href="javascript:Main.downloadFile('34537569891fa9bf', 142)"> <img border=0 class="icon" title="Download the contents of this file" src="/base2/images/download.gif"></a>

which will produce a link to the specified raw file.

Wow, that's a bug, HTML tags should be escaped. Besides, it won't work anyway, since the first parameter to the downloadFile function is a session ID and is different for every time you login.

[Nicklas Nordborg]

I seems that both the view page and list pages is affected by this. The view page is shared among all items (/www/common/annotations/list_annotations.jsp), but the list pages are not. The "Inherit annotations" page is also affected. Maybe there are even more places that are affected. For example:

• The "View experiment" page lists annotations used as experimental factors
• Experiment explorer can display annotations
• The plot tool can use annotations
• more?

[Nicklas Nordborg]

Moved to milestone 2.2 since it interfers with changes that has been made in 2.2.

[Martin Svensson]

(In [2893]) Fixes #428 HTML tags in annotation values are not escaped.