google / google/closure-templates
Trusted URIs aren't composable
- Dominant language
- Java
- Stars
- 700
- Forks
- 199
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 26
Description
Consider the following template:
```soy
{template .asset_link kind="trusted_resource_uri" visibility="private"}
{@param uri: trusted_resource_uri} /** URI postfix to apply. */
{@inject? cdn_prefix: trusted_resource_uri} /** CDN prefix to use, if applicable. */
{if isNonnull($cdn_prefix)}
{$cdn_prefix}{$uri}
{else}
{$uri}
{/if}
{/template}
```
From the type names, it's implied that this would work and skip escaping, because, even though the `trusted_resource_uri` we're returning isn't a constant _itself_, per se, the two items it is _composed of_ are trusted constants.
Instead, however, invoking this template returns something like:
`https://cdn_prefix.com/some%2Fescaped%2Furl%2Fhere.css`
Which obviously doesn't work. In the above example, the CDN prefix is essentially just a display detail, hence why we want to keep it in Soy. Because there isn't a way to compose `string` types into `trusted_resource_uri` types (for good reason) from within Soy itself, is there any way to accomplish the above smoothly?
In our case, `uri` is itself already a `trusted_resource_uri` when Soy begins the render process. So, _composing_ these two URIs is a rather challenging task, even from pure Java, because we'd have to disassemble/re-assemble the `TrustedResourceUriProto`, which is also verboten.
Contributor guide
Assessment
This issue has not been assessed yet.