From 149337d77ddbbef3b45bc6ca2750405f86c172e9 Mon Sep 17 00:00:00 2001
From: Graham Knop <graham@plainblack.com>
Date: Wed, 12 Nov 2008 21:28:18 +0000
Subject: [PATCH] encode html entities when used in a setLink or setScript
 attribute value

---
 lib/WebGUI/Session/Style.pm | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/WebGUI/Session/Style.pm b/lib/WebGUI/Session/Style.pm
index 14791a24c..b2a6cf021 100644
--- a/lib/WebGUI/Session/Style.pm
+++ b/lib/WebGUI/Session/Style.pm
@@ -21,6 +21,7 @@ use WebGUI::International;
 use WebGUI::Macro;
 use WebGUI::Asset::Template;
 use WebGUI;
+use HTML::Entities ();
 
 =head1 NAME
 
@@ -281,7 +282,7 @@ sub setLink {
 	return undef if ($self->{_link}{$url});
 	my $tag = '<link href="'.$url.'"';
 	foreach my $name (keys %{$params}) {
-		$tag .= ' '.$name.'="'.$params->{$name}.'"';
+		$tag .= ' '.$name.'="'.HTML::Entities::encode($params->{$name}).'"';
 	}
 	$tag .= ' />'."\n";
 	$self->{_link}{$url} = 1;
@@ -391,7 +392,7 @@ sub setScript {
 	return undef if ($self->{_javascript}{$url});
 	my $tag = '<script src="'.$url.'"';
 	foreach my $name (keys %{$params}) {
-		$tag .= ' '.$name.'="'.$params->{$name}.'"';
+		$tag .= ' '.$name.'="'.HTML::Entities::encode($params->{$name}).'"';
 	}
 	$tag .= '></script>'."\n";
 	$self->{_javascript}{$url} = 1;