Re: How to set configuration to always using ?html ?

That's the idea. Shouldn't really hurt the performance, I think -  
template loading should be infrequent, given the caching.

Attila.

On 2008.02.20., at 18:03, Newman, John W wrote:

> " implement your own TemplateLoader that
> inserts the directive tags at the beginning and the end"
>
>
> Actually, do you know how I would go about that?  All I've got in  
> the template loader interface is
>
>
>        void closeTemplateSource(Object arg0) throws IOException;
>        Object findTemplateSource(String arg0) throws IOException;
>        long getLastModified(Object arg0);
>        Reader getReader(Object arg0, String arg1) throws IOException;
>
> Does it involve the getReader?  Do I create another reader with the  
> hook I need and dump the contents of super.getReader into it?  Won't  
> that hurt performance a good bit?  Or am I way off here?
>
> Thanks again!
>
> -----Original Message-----
> From: [email protected] [mailto:[email protected] 
> ] On Behalf Of Attila Szegedi
> Sent: Wednesday, February 20, 2008 11:09 AM
> To: FreeMarker-user
> Subject: Re: [FreeMarker-user] How to set configuration to always  
> using ?html ?
>
> You can't set it in configuration, but you can enclose the body of
> each of your templates into a [#escape x as x?html]...[/#escape]  
> block.
>
> See <http://freemarker.org/docs/ref_directive_escape.html>
>
> There's been some talk about making a feature that'll automatically
> escape all interpolations in all loaded templates. For now, if you
> want it automatically, you can implement your own TemplateLoader that
> inserts the directive tags at the beginning and the end of the loaded
> template content.
>
> Attila.
>
> On 2008.02.20., at 16:36, Newman, John W wrote:
>
>> Hi,
>>
>> I just found out that I need to always use ?html in html pages!  I
>> entered  <script>alert('boo');</script> on a text field, and got an
>> alert on the next page that output this value!
>>
>> So I can go through all my web pages search for ${.*} and replace it
>> with ${.*?html}, but isn't there a simple way to set that in the
>> configuration?  I haven't been able to find it thus far, any help is
>> appreciated.  Also is there any reason that would not be a good
>> idea, even if I am always rendering html?
>>
>> Thanks,
>> John





-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/