2

I'm trying to migrate some code over to using dynamicComponents to avoid some XSS vulnerabilities and it's not working how I would expect it to when inside any type of repeat functionality (apex:repeat, apex:pageBlockTable)

Reproducer

public class CompTest {
    class InnerClass {
        public Component.Apex.OutputText getDynamicComp() {
            Component.Apex.OutputText comp = new Component.Apex.OutputText(escape = false);
            comp.value = '<b>test</b> test';
            return comp;
        }
    }

    public InnerClass singleComp {
        get;
        set;
    }

    public List<InnerClass> compList {
        get;
        set;
    }

    public CompTest() {
        this.singleComp = new InnerClass();
        this.compList = new List<InnerClass> {
            new InnerClass(),
            new InnerClass()
        };
    }
}

Controller

<apex:page controller="CompTest">
    <h1>Single Comp</h1>
    <br />
    **<apex:dynamicComponent componentValue="{!singleComp.dynamicComp}" />**

    <br />
    <h1>Comp List</h1>
    <br />
    <apex:repeat value="{!compList}" var="comp">
        **<apex:dynamicComponent componentValue="{!comp.dynamicComp}" />**
        <br />
    </apex:repeat>
</apex:page>

Visualforce

Output

Visualforce Output

This looks like a bug to me, but I'd like to know if anyone has seen this before, or if I'm missing something in the documentation that says you can't use the apex:dynamicComponent inside a looping tag.

2

I was able to get this to work by setting the invokeAfterAction attribute on the dynamic component in the repeat.

**<apex:dynamicComponent componentValue="{!comp.dynamicComp}" invokeAfterAction="true" />**

  • That works great. Any idea if this is how it's suppose to work or just a "work around"? – Patrick Connelly Mar 3 '17 at 19:44
  • My guess is that it has something to do with the order of how things are rendered in the page. invokeAfterAction changes that order. There's more on it here but I don't see anything directly relevant. – John Towers Mar 3 '17 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.