Question

I couldn’t figure it out where “document object” in the code below can possibly be injected into a JSP file:

  <a href="#"
   onclick="document.forms[0]['filePickerAction'].value='pickAltView';
   document.forms[0]['filePickerFrom'].value='<spring:message
     code="filePickerMessage.pickAltViewXsl" />';
   document.forms[0].submit();return false;">
 <fmt:message key="text_selectAltViewXsl"/></a>

Do you have any ideas?

Answer 1

It’s a global JavaScript variable which refers to the current HTML DOM tree which is been created by the webbrowser after parsing the HTML document which the webbrowser has retrieved from the webserver. This JavaScript variable has nothing to do with JSP or any server-side language. JSP is merely a HTML code generator and doesn’t run in sync with JavaScript. Rightclick the page in browser, do a View Source and all you see is plain HTML. If Java/JSP has done its job right, you should not see any single line of it. The webbrowser uses the HTML DOM tree to render the page to the client and exposes it as document variable into JavaScript context. It allows JavaScript programmers to access, traverse and manipulate the HTML DOM tree.

See also:

• Gecko DOM Reference – Introduction
• Wikipedia – Document Object Model