SUGGESTION: Allow encodeAs attribute on sec: taglib tags
- Dominant language
- Groovy
- Stars
- 2.9k
- Forks
- 975
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 92
Description
Currently, it appears all the tags in the `sec:` taglib very explicitly call `encodeAsHTML()` on any output they return.
https://github.com/grails-plugins/grails-spring-security-core/blob/071b036101fc2a20f71816ece9fc603caff74a80/plugin/grails-app/taglib/grails/plugin/springsecurity/SecurityTagLib.groovy#L124
There are uses for having the tags return results in other encodings. For example, returning an MD5 hash of the logged-in user's **email** field to send direct in a Gravatar image link. Or even returning as raw so that the hash could then be computed manually on a non-HTML encoded email address (which changes the `@` to an HTML entity).
Because the tags are explicitly handling the encoding, using `raw()` doesn't help—the output has already been encoded by the time `raw()` can get it. The canned Grails tags (`g:`) supposedly (according to documentation) support an `encodeAs` attribute to override the default encoding. That could also be an option.
For your consideration. Thanks!
Contributor guide
Research direction
Start with plugin/grails-app/taglib/grails/plugin/springsecurity/SecurityTagLib.groovy, including the linked code around line 124, to inspect how sec: tags encode returned output. Compare the requested behavior with the documented encodeAs option on Grails g: tags. Done means sec: tags retain HTML encoding by default while allowing callers to request another encoding or raw output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- groovy
- Domain
- web-dev
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100