apache / apache/grails-core

raw is broken, value seems pre-encoded

Open
#14,214 0 comments 0 reactions 0 assignees View on GitHub
relates-to: grails-fields
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

I wanted to make a field template that has pre-encoded HTML:
__fields/contract/contractTerms/displayWidget.gsp:_

`${raw(value)}`

value is expected to contain HTML. However, raw() doesn't work inside a template.

I put this in to see what happens:
`${raw(value[0])}`

And for HTML that starts with a tag... `

    ` it outputs `&` confirming that it's the start of an encoded string of `<`

    I find it quite bizarre that it encodes the value before it even gets to the template, because this precludes a whole range of processing that one might be inclined to do in the template. Certainly I've never seen this behaviour in any other grails templates where raw() works fine.

    As far as I can see, the problem exists in FormFieldsTagLib.groovy line 448:

    ```
    if (value instanceof String && encoding) {
    value = codecLookup.lookupEncoder(encoding).encode(value)
    }
    ```

    Straight off the bat, special casing String at this level looks dodgy. The code at this level shouldn't be making any decisions about the meaning of the String and how it's going to be output. The String could be any number of of special things that should be passed through unmolested.

    I might add, that the output is actually getting double encoded. I proved this by re-rawing the value..

    `${value.replaceAll('<', '<').replaceAll('>', '>'))
    `
    This still doesn't get output as raw HTML. I have to do...

    `${raw(value.replaceAll('<', '<').replaceAll('>', '>'))}
    `
    That indicates that the already-html-encoded value is getting re-encoded a 2nd time.
    `

Contributor guide

Open the contributing guide

Research direction

Start at FormFieldsTagLib.groovy line 448 and reproduce the issue with the __fields/contract/contractTerms/displayWidget.gsp template using a value containing HTML. Trace where the String is encoded before raw() runs; done means pre-encoded HTML is not encoded again and raw(value) produces the intended HTML output.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy
Domain
web-dev
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.