From 1942e94cec6b6a30532716d14da5c7cd0cd8f075 Mon Sep 17 00:00:00 2001
From: Sergey <sergey.gorbaty@salesforce.com>
Date: Thu, 2 Mar 2017 15:57:26 -0800
Subject: [PATCH] Bug fix

---
 .../lang/vf/rule/security/VfUnescapeElRule.java  |  3 ++-
 .../lang/vf/rule/security/xml/VfUnescapeEl.xml   | 16 ++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java b/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java
index bb4928797f..0255fe2962 100644
--- a/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java
+++ b/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/vf/rule/security/VfUnescapeElRule.java
@@ -60,6 +60,7 @@ public class VfUnescapeElRule extends AbstractVfRule {
 
             if (n instanceof ASTText) {
                 prevText = (ASTText) n;
+                continue;
             }
 
             if (n instanceof ASTElExpression) {
@@ -92,7 +93,7 @@ public class VfUnescapeElRule extends AbstractVfRule {
 
     private boolean isUnbalanced(String image, String pattern) {
         int occurance = 0;
-        int index = image.lastIndexOf("=");
+        int index = image.indexOf("=");
         index = image.indexOf(pattern, index + 1);
         while (index >= 0) {
             occurance++;
diff --git a/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml b/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml
index f75de0a90c..1b32a95d80 100644
--- a/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml
+++ b/pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml
@@ -1,6 +1,22 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <test-data>
 
+<test-code>
+		<description><![CDATA[
+No XSS in safe commands quoted context
+     ]]></description>
+		<expected-problems>0</expected-problems>
+		<code><![CDATA[
+<apex:page>
+	<script>
+	window.parent.opener.location.href = '/apex/FSINT_BRAZIL_CaseViewPage?Id={!case.Id}&isdtp=vw';
+	</script>
+</apex:page>
+]]></code>
+		<source-type>vf</source-type>
+	</test-code> 
+
+
  	<test-code>
 		<description><![CDATA[
 No XSS in safe commands quoted context