Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

raw is broken, value seems pre-encoded #313

Open
xpusostomos opened this issue Mar 29, 2021 · 0 comments
Open

raw is broken, value seems pre-encoded #313

xpusostomos opened this issue Mar 29, 2021 · 0 comments

Comments

@xpusostomos
Copy link

xpusostomos commented Mar 29, 2021

I wanted to make a field template that has pre-encoded HTML:
_fields/contract/contractTerms/displayWidget.gsp:

${raw(value)}

value is expected to contain HTML. However, raw() doesn't work inside a template.

I put this in to see what happens:
${raw(value[0])}

And for HTML that starts with a tag... <ol> it outputs & confirming that it's the start of an encoded string of &lt;

I find it quite bizarre that it encodes the value before it even gets to the template, because this precludes a whole range of processing that one might be inclined to do in the template. Certainly I've never seen this behaviour in any other grails templates where raw() works fine.

As far as I can see, the problem exists in FormFieldsTagLib.groovy line 448:

		if (value instanceof String && encoding) {
			value = codecLookup.lookupEncoder(encoding).encode(value)
		}

Straight off the bat, special casing String at this level looks dodgy. The code at this level shouldn't be making any decisions about the meaning of the String and how it's going to be output. The String could be any number of of special things that should be passed through unmolested.

I might add, that the output is actually getting double encoded. I proved this by re-rawing the value..

${value.replaceAll('&lt;', '<').replaceAll('&gt;', '>'))
This still doesn't get output as raw HTML. I have to do...

${raw(value.replaceAll('&lt;', '<').replaceAll('&gt;', '>'))}
That indicates that the already-html-encoded value is getting re-encoded a 2nd time.
`

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants