Re: Need to validate ftl before saving in DB

Tuesday, February 16, 2010, 8:37:38 AM, Rishabh Joshi wrote:

> Hi Daniel,
>
> Thanks for your response.
> I doubled checked for the exception, by debugging through the code. And this is what I noticed:
>
> In my UI, I enter the following template
> <#list ig as row>"${row.assessmentId}"</#list>
>
> which gets converted to:
> &lt;#list ig as row&gt;&quot;${row.assessmentId}&quot;&lt;/#list&gt;

Then there is the problem. What does the HTML-escaping? &lt;#list etc.
is not and FTL directive for FreeMarker, just plain text that will be
printed as-is.

> before it reaches the code where I perform the validation. On
> proceeding further, an exception is *not thrown*.
> In the next iteration, I changed the incoming template string
> within the debugger, before it reaches the validation code, to the original value -
> <#list ig as row>"${row.assessmentId}"</#list>
> and now, it did throw an exception as stated by you.
>
> Is this the expected behaviour of freemarker?

No. The template shouldn't be HTML-escaped before it reaches the
parser of FreeMarker.

> Regards,
> Rishabh
>
> 2010/2/16 Daniel Dekany <[email protected]>
> Monday, February 15, 2010, 10:21:47 AM, rishabh9 wrote:
>
>>
>> Hi,
>>
>> I use the below code to validate a ftl string I get from the UI, before
>> saving in the DB. If an exception is thrown, I know there is a validation
>> error and I report it accordingly to the UI.
>>
>> ================= BEGIN CODE ======================
>>
>> Configuration config = new Configuration();
>> config.setStrictSyntaxMode(true);
>> config.setTagSyntax(Configuration.AUTO_DETECT_TAG_SYNTAX);
>>
>> StringTemplateLoader stringLoader = new StringTemplateLoader();
>> stringLoader.putTemplate(name, content);
>> config.setTemplateLoader(stringLoader);
>>
>> try {
>>     config.getTemplate(name);
>> } catch (IOException e) {
>>     LOG.error("The template's body is malformed.");
>>     throw new CustomException("The template body is malformed.", e);
>> }
>>
>> =================== END CODE =====================
>>
>> My problem is that, the above code seems to work partly. It does not
>> validate the directives.
>> For example, even if I miss out on closing a directive, the
>> "config.getTemplate(name)" does not throw an exception -
>>     <#list animals as being>
>>         ${being.name}
>
> You mean, if the </#list> is missing, getTemplate doesn't throw
> exception? Double-check that... it meant to throw exception in that
> case:
>
>  freemarker.core.ParseException: Unexpected end of file reached.
>  Unclosed list directive.
>
>> An exception is thrown, only when a variable, like - "${being.name}" is
>> typed erroneously; something like - "${being"
>>
>> How can I validate the the directives?
>
> The *syntax* of directives (and of everything) is always checked by
> getTemplate. In general, all Template objects correspond to a
> syntactically correct template, since they store the template as
> abstract syntax tree (not as text), so they are technically unable to
> store syntactically wrong templates.
>
> Note that typos in variable *names* (including user-defined directive
> names, the <@...> stuff) are not checked by getTemplate; they only
> cause error when the template is evaluated (means: executed, generate
> the output) with Template.process(...) or Environment.process(...).
> Also, bad paths is #include/#import are not validated until the
> template is evaluated, since unlike in C, those are runtime
> instructions in FreeMarker.
>
>> Also, Is this the correct way to completely validate a template?
>
> Yes, that does the most comprehensive validation available, apart from
> actually evaluating the template, as I pointed out earlier. Note that
> the Template object returned by getTemplate will be cached and so it
> will consume RAM even if you don't want to get it again in the
> foreseeable future. If that's a problem, you can always purge the
> cache:
>
> http://freemarker.org/docs/api/freemarker/template/Configuration.html#clearTemplateCache%28%29
>
>> I am using freemarker version 2.3.13
>>
>> Regards,
>> Rishabh
>
> --
> Best regards,
>  Daniel Dekany

-- 
Best regards,
 Daniel Dekany


------------------------------------------------------------------------------
SOLARIS 10 is the OS for Data Centers - provides features such as DTrace,
Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW
http://p.sf.net/sfu/solaris-dev2dev