apache / apache/grails-core

SUGGESTION: Allow encodeAs attribute on sec: taglib tags

Open
#15,888 0 comments 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

Currently, it appears all the tags in the `sec:` taglib very explicitly call `encodeAsHTML()` on any output they return.
https://github.com/grails-plugins/grails-spring-security-core/blob/071b036101fc2a20f71816ece9fc603caff74a80/plugin/grails-app/taglib/grails/plugin/springsecurity/SecurityTagLib.groovy#L124

There are uses for having the tags return results in other encodings. For example, returning an MD5 hash of the logged-in user's **email** field to send direct in a Gravatar image link. Or even returning as raw so that the hash could then be computed manually on a non-HTML encoded email address (which changes the `@` to an HTML entity).

Because the tags are explicitly handling the encoding, using `raw()` doesn't help—the output has already been encoded by the time `raw()` can get it. The canned Grails tags (`g:`) supposedly (according to documentation) support an `encodeAs` attribute to override the default encoding. That could also be an option.

For your consideration. Thanks!

Contributor guide

Open the contributing guide

Research direction

Start with plugin/grails-app/taglib/grails/plugin/springsecurity/SecurityTagLib.groovy, including the linked code around line 124, to inspect how sec: tags encode returned output. Compare the requested behavior with the documented encodeAs option on Grails g: tags. Done means sec: tags retain HTML encoding by default while allowing callers to request another encoding or raw output.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy
Domain
web-dev
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.