Re: How to set configuration to always using ?html ?

" implement your own TemplateLoader that
inserts the directive tags at the beginning and the end"


Actually, do you know how I would go about that?  All I've got in the template loader interface is


        void closeTemplateSource(Object arg0) throws IOException;
        Object findTemplateSource(String arg0) throws IOException;
        long getLastModified(Object arg0);
        Reader getReader(Object arg0, String arg1) throws IOException;

Does it involve the getReader?  Do I create another reader with the hook I need and dump the contents of super.getReader into it?  Won't that hurt performance a good bit?  Or am I way off here?

Thanks again!

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Attila Szegedi
Sent: Wednesday, February 20, 2008 11:09 AM
To: FreeMarker-user
Subject: Re: [FreeMarker-user] How to set configuration to always using ?html ?

You can't set it in configuration, but you can enclose the body of
each of your templates into a [#escape x as x?html]...[/#escape] block.

See <http://freemarker.org/docs/ref_directive_escape.html>

There's been some talk about making a feature that'll automatically
escape all interpolations in all loaded templates. For now, if you
want it automatically, you can implement your own TemplateLoader that
inserts the directive tags at the beginning and the end of the loaded
template content.

Attila.

On 2008.02.20., at 16:36, Newman, John W wrote:

> Hi,
>
> I just found out that I need to always use ?html in html pages!  I
> entered  <script>alert('boo');</script> on a text field, and got an
> alert on the next page that output this value!
>
> So I can go through all my web pages search for ${.*} and replace it
> with ${.*?html}, but isn't there a simple way to set that in the
> configuration?  I haven't been able to find it thus far, any help is
> appreciated.  Also is there any reason that would not be a good
> idea, even if I am always rendering html?
>
> Thanks,
> John


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
FreeMarker-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/freemarker-user

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/