Re: Escaping by default -- possible without editing the lib?

Tuesday, June 8, 2010, 9:49:51 PM, Tim McCormack wrote:

> I'm looking into a number of HTML templating libraries, and so far they all have
> the downside of providing no way to escape all data for HTML by *default*.

Yeah, strange, isn't it? I guess GXP (Google XML Pages) does that,
being XHTML-aware and all... but I have never find the time too look
into it closely. Also Zope TAL does that (Python...). In general,
template engines that are XML-based used to escape by default.

And now that you mention this, this is one of those top annoyances
that might should be addressed in 3.0 or in 2.4. But it's tricky, as
FM is an output-format-unaware template engine (hence the explicit
escaping in it)... so how to decide which template should be
auto-escaped, especially without breaking older templates? Maybe there
should be something like cfg.setAutoEscaper(AutoEscaper) where
AutoEscaper is
interface AutoEscaper {String getEscapingExpression(String TemplateName)},
where getEscapingExpression returns null if no escaping is needed,
otherwise it returns something like "x as x?html". Then one could set
up a rule like *.hftl is escaped with "x as x?html" by default.

> In the case of FreeMarker, I'm aware of the <#escape as> directive, but the
> developer has to remember to include that on every page! This makes me a bit
> uneasy -- just like having to remember to put charset=UTF-8 on every page
> instead of instructing the server to always add that header.
>
> Other than hacking on the jar, is there a way to ensure that the default is to
> escape all ${data} as HTML?

There is no out-of-the-box solution for that. But there is a solution
that doesn't require you to patch FreeMarker: You can create a custom
TemplateLoader that adds <#escape as> and </#escape> around the
templates on-the-fly. That approach has two quirks, however:

- It displaces the error locations. However, if the opening escape
  tag has no line-break after it (not in it), it only affects the
  first line of the original template, so it's not a that big issue
  usually.

- If the template already uses <#escape x as x?html>, you end up with
  double-escaping. However, the TemplateLoader could detect that
  situation.  That's a bit tricky to do 100% correctly, as it should
  involve some syntactical parsing to spot the escapings.

>  - Tim McCormack

-- 
Best regards,
 Daniel Dekany


------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate 
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the 
lucky parental unit.  See the prize list and enter to win: 
http://p.sf.net/sfu/thinkgeek-promo