major
nice-to-have
minor
#25217
Layout-Export führt zu invaliden Komponenten-Referenzen bei Referenzierung einer bestehenden Komponente
#25327
Modell-Editor: Falsche Kompositionsmarker, wenn Container-Typ in Diagramm von Content-Typ gezogen wird
defect
A tooltip is an HTML string. If you generate the internationalized text in a tooltip using a tl:ResKey with dynamic arguments, you must ensure that all arguments are quoted beforehand. Otherwise, the argument is inserted into the message as-is. If the argument contains HTML code, it will be executed in the browser.
An example of this is the tl:ResourceProvider for tl:Person:
It’s just as disastrous to simply return getLabel() as a tooltip. Since the label is an arbitrary string but the tooltip is HTML, the label must be quoted beforehand to be used as a tooltip:
The problems with this approach are nearly countless:
- com.top_logic.util.monitor.db.SQLResourceProvider
- com.top_logic.kafka.layout.sensors.SensorActivityStateResourceProvider
- com.top_logic.risk.layout.RiskItemAccessor.MetaElementTypeResourceProvider
- com.top_logic.extensions.ewe.layout.worklist.WorklistEntryResourceProvider
- com.top_logic.project.pos.reporting.producer.MTAChartModelBuilder.createUI().new I18NResourceProvider() {...}.(ResPrefix)
- com.top_logic.milestone.reporting.mta.MTAFilterComponent.fill().new I18NResourceProvider() {...}.(ResPrefix)
- com.top_logic.risk.layout.label.StatusReportResourceProvider
- com.top_logic.vw.pmt.riskitem.PMTRiskResourceProvider (mgrType)
- com.top_logic.vw.pmt.layout.targetproduct.TargetProductResourceProvider (theType)
- com.top_logic.vw.pmt.program.PMTProgramResourceProvider (theType)
- com.top_logic.knowledge.gui.layout.person.PersonResourceProvider
- com.top_logic.project.stem.effort.EffortLineResourceProvider
- com.top_logic.committee.layout.decision.DecisionMemoResourceProvider
- com.top_logic.contact.layout.ContactResourceProvider (super.getLabel())
- com.top_logic.vw.pmt.layout.orgUnit.CritResponseResourceProvider
The only safe solution seems to be that the API string getTooltip() must be removed from tl:ResourceProvider.
Valid Tooltips
- If the tooltip is the translation of a ResKey with arguments, the arguments must be quoted. For example: {{{
String getTooltip(Object o) { return _resources.getMessage(_tooltipKey, TagUtil.encodeXML(arg1), ..., TagUtil.encodeXML(arg_n)); } }}}
- If the tooltip is determined by other functions (e.g., via the label), the value must be quoted before being returned: {{{
String getTooltip(Object o) { return TagUtil.encodeXML(getLabel(o)); } }}}
Code Migration
Overrides of AbstractTLItemResourceProvider#getTooltipValues(Resources, Object) must return the plain tooltip values. The values are quoted in the superclass, meaning that calls to TagUtil#encodeXML(...) for values in the result array are no longer necessary.
Test
Example for the tl:ResourceProvider for tl:Person:
- Create an entry
- Create an entry for the first name <img src="error.png"/>
- Display the associated contact.
- Display the tooltip for the link to the user.
- Expected behavior: Instead of a missing image, <img src="error.png"/> should be displayed as the first name.