Merge branch '3.1.x' of github.com:grails/grails-core into 3.1.x

Author: graemerocher

grails-core/src/test/groovy/org/grails/config/PropertySourcesConfigSpec.groovy

@@ -2,6 +2,8 @@ package org.grails.config
 
 import org.springframework.core.env.MapPropertySource
 import org.springframework.core.env.MutablePropertySources
+import spock.lang.Ignore
+import spock.lang.Issue
 import spock.lang.Specification
 
 /*
@@ -48,4 +50,28 @@ class PropertySourcesConfigSpec extends Specification {
 
 
     }
+
+    /*
+
+      We need to settle on whether the following is a bug or not.
+      There are some tests in ConfigMapSpec that indirectly assert some
+      behavior that I think would be inconsistent with making the following
+      test pass.
+
+     */
+    @Ignore
+    @Issue('grails/grails-core#10188')
+    void 'test replacing nested property values'() {
+        given: 'a PropertySourcesConfig'
+        def cfg = new PropertySourcesConfig()
+
+        when: 'a nested property is assigned a value'
+        cfg.foo.bar = ['one': '1']
+
+        and: 'later is assigned a different value'
+        cfg.foo.bar = ['two': '2']
+
+        then: 'the second value is not merged with the first value'
+        cfg.foo.bar == ['two': '2']
+    }
 }

grails-plugin-gsp/src/main/groovy/org/grails/plugins/web/taglib/FormTagLib.groovy

@@ -1069,7 +1069,7 @@ class FormTagLib implements ApplicationContextAware, InitializingBean, TagLibrar
             }
         }
         keyValue = processFormFieldValueIfNecessary(selectName, "${keyValue}","option")
-        writer << "value=\"${keyValue}\" "
+        writer << "value=\"${keyValue.toString().encodeAsHTML()}\" "
         if (selected) {
             writer << 'selected="selected" '
         }

grails-test-suite-web/src/test/groovy/org/grails/web/taglib/SelectTagTests.groovy

@@ -22,6 +22,14 @@ class SelectTagTests extends AbstractGrailsTagTests {
         assertTrue "should have HTML escaped attributes", result.startsWith('<select id="bar&quot; /&gt;&lt;script&gt;alert(&quot;gotcha&quot;)&lt;/script&gt;.genre" name="bar&quot; /&gt;&lt;script&gt;alert(&quot;gotcha&quot;)&lt;/script&gt;.genre" >')
     }
 
+    void testSelectTagEscapingValue() {
+        def template = '<g:select id="genre" name="genre" from="${values}" />'
+        def result = applyTemplate(template, [values: ["\"></option></select><script>alert('hi')</script>"]])
+
+        println result
+        assertTrue "should have HTML escaped values", result.contains('<option value="&quot;&gt;&lt;/option&gt;&lt;/select&gt;&lt;script&gt;alert(&#39;hi&#39;)&lt;/script&gt;" >&quot;&gt;&lt;/option&gt;&lt;/select&gt;&lt;script&gt;alert(&#39;hi&#39;)&lt;/script&gt;</option>')
+    }
+
     void testSelectUsesExpressionForDisable() {
         def template = '<g:set var="flag" value="${true}"/><g:select disabled="${flag}" name="foo" id="foo" from="[1,2,3]" />'
         assertOutputContains('disabled="disabled"', template)