« Return to Thread: Is it possible to make ?html the default?

Is it possible to make ?html the default?

by mraible :: Rate this Message:

Reply to Author | View in Thread

I'd like to turn on HTML/XML escaping by default to avoid XSS issues in my application. Is this possible? I tried the following with Spring MVC, but it doesn't seem to work:

    <bean id="freemarkerConfig" class="org.springframework.web.servlet.view.freemarker.FreeMarkerConfigurer">
        <property name="templateLoaderPath" value="/"/>
        <property name="freemarkerSettings">
            <props>
                <prop key="datetime_format">MM/dd/yyyy</prop>
                <prop key="number_format">0.######</prop>
            </props>
        </property>
        <property name="freemarkerVariables">
            <map>
                <entry key="html_escape" value-ref="fmHtmlEscape"/>
            </map>
        </property>
    </bean>

    <bean id="fmHtmlEscape" class="freemarker.template.utility.HtmlEscape"/>

In my template, I have:

<#assign test = "<strong>stuff</strong>">
test = ${test}

And it prints out stuff in bold. If I use ${test?html}, it does what I want. I'd like to invert the logic, so escaping is the default and ?html turns off escaping. I'm not as concerned about turning off escaping as I am about making escaping the default.

Thanks,

Matt

 « Return to Thread: Is it possible to make ?html the default?