Template values are not html escaped

[ldaley]

When output in html templates, the html() method should be used to escape the value: https://github.com/ratpack/ratpack/blob/master/ratpack-groovy/src/main/java/ratpack/groovy/templating/TemplateScript.java#L65-65

[danhyun]

Started work here: https://github.com/danhyun/example-books/tree/markup-template

Just as an FYI, it looks like you don't get escaped values for free.

div(foo) will not escape foo whereas div { yield foo } does.

[ldaley]

@melix is this the case? Or are we missing something here? According to your blog post (http://melix.github.io/blog/2014/02/markuptemplateengine.html) this should be escaped.

[melix]

Automatic escaping works from variables read from the model and if autoEscape is set to true in the configuration. Otherwise, you have to write explicit calls to yield.

[ldaley]

I'd be inclined to default that to on in Ratpack. What do you think @melix ? I'd rather have surprising garbled output than injection attack vectors.

[melix]

It makes sense.

[danhyun]

For this particular project I'll just pretend that autoescaping is turned on, in the meanwhile I have opened an issue (ratpack/ratpack#376) and submitted a pull request (ratpack/ratpack#377) for enabling autoEscape by default.