google / google/closure-templates

Trusted URIs aren't composable

Open
#203 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
700
Forks
199
Avg merge
2d 12h
Merged PRs (30d)
26

Description

Consider the following template:
```soy
{template .asset_link kind="trusted_resource_uri" visibility="private"}
{@param uri: trusted_resource_uri} /** URI postfix to apply. */
{@inject? cdn_prefix: trusted_resource_uri} /** CDN prefix to use, if applicable. */

{if isNonnull($cdn_prefix)}
{$cdn_prefix}{$uri}
{else}
{$uri}
{/if}
{/template}
```

From the type names, it's implied that this would work and skip escaping, because, even though the `trusted_resource_uri` we're returning isn't a constant _itself_, per se, the two items it is _composed of_ are trusted constants.

Instead, however, invoking this template returns something like:
`https://cdn_prefix.com/some%2Fescaped%2Furl%2Fhere.css`

Which obviously doesn't work. In the above example, the CDN prefix is essentially just a display detail, hence why we want to keep it in Soy. Because there isn't a way to compose `string` types into `trusted_resource_uri` types (for good reason) from within Soy itself, is there any way to accomplish the above smoothly?

In our case, `uri` is itself already a `trusted_resource_uri` when Soy begins the render process. So, _composing_ these two URIs is a rather challenging task, even from pure Java, because we'd have to disassemble/re-assemble the `TrustedResourceUriProto`, which is also verboten.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.