File path on JSP and javascript

Question

trying to put a file path in javascript. it is a pain \ is an escape character and it always kill the character after the backslash

what i am doing is this i am trying to add the file path from a jsp view object attribute

window.open("file"+<c:out value="${filePath}" />+fileName); 

but if there are backslash in the end of filePath, it kills the following quotation mark

what is the most efficient workaround. do i have to change the java attribute notation (which i dont want to) or get a script to do it ?

Answer 1

JavaScript encoding is required here for the reason that the c:out tag performs HTML encoding atleast for some meta characters, but not JavaScript encoding. In this case, JavaScript encoding of the output is required, since the output of the c:out tag appears in a JavaScript context.

Note: You can use ESAPI to perform this, via the JavaScriptCodec class. It would also protect you from XSS if possible via the filePath variable.

Answer 2

seems that i am looking for this http://static.springsource.org/spring/docs/1.1.5/taglib/tag/MessageTag.html

i simply put

<spring:message text="${filePath}" javaScriptEscape="true"/>

there is a javaScriptEscape escape attribute that allows me get the string in the javascript friendly form. hence i thought it simple solution

Answer 3

Use / instead of \. The / works fine in Windows as well. You can use fn:replace() to replace it.

<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
...
window.open("file${fn:replace(filePath, '\\', '/')}" + fileName); 

Note that I also fixed the "string concatenation". Concatenating c:out in Javascript style makes no sense.