You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@velocity.apache.org by Jeff Schnitzer <je...@infohazard.org> on 2002/05/31 04:08:42 UTC
escaping xml characters
Is there a way to get Velocity to automatically escape XML characters?
I notice that it currently isn't doing so, and I don't see any
configuration keys for this. If I missed something, please enlighten me
and ignore the rest of this message :-)
I'm hoping it can work something like the JSTL tags, which offers this
facility: <c:out value="${blah}" escapeXml="false"/> with a default of
true. Struts tags also automatically escape XML chars unless you
specify otherwise.
I need to escape all velocity expressions unless I explicitly specify
otherwise. I'll propose that anyone else using velocity to build web
applications also needs this same facility, otherwise they are probably
vulnerable to CSS attacks. There was a long discussion of
cross-site-scripting vulnerabilities on Jakarta-general last year. (for
the reason it is not appropriate to try to escape data on input:
http://www.mail-archive.com/general@jakarta.apache.org/msg02200.html)
I propose a velocity config key (runtime.escapexml?) that defaults to
false (for backwards compatibility). I also propose an additional
snippet of syntax, like $:blah, which inverts the xml escaping. I'm not
particular about the character or syntax, but it needs to be possible.
Jeff Schnitzer
jeff@infohazard.org
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: escaping xml characters
Posted by "Geir Magnusson Jr." <ge...@adeptra.com>.
On 5/31/02 8:31 AM, "Attila Szegedi" <sz...@freemail.hu> wrote:
> ----- Original Message -----
> From: "Geir Magnusson Jr." <ge...@adeptra.com>
> To: <ve...@jakarta.apache.org>
> Sent: 2002. május 31. 14:06
> Subject: Re: escaping xml characters
>
>
>>
>> <thinking out loud>
>>
>> Rather than a single-purpose use of ":", I wonder if we can do some sort
> of
>> 'ReferenceAction'
>>
>> $foo:action
>>
>> type of syntax (I guess like the freemarker $foo?bar ?) but leave the
> action
>> completely defined by the application? Then you define an action event
>> handler that gets invoked.
>>
>
> Well, FreeMarker has a feature for exactly this purpose and it's called
> transform tools. These are essentially character stream filters. In FM to
> perform XML escaping in a block you place an instance of
> freemarker.template.utilities.XmlEscape in the context under some name (say,
> "xmlEscape"). Then in the template you can use
> <transform xmlEscape>
> ...
> </transform>
> to apply the transform to the encompassed block. The block itself can of
> course contain any valid FTL construct, including even nested transforms. It
> works much like the body-processing tags in JSP taglibs. There are stock
> implementations for XML/HMTL escaping as well as some more exotic ones (like
> one that transforms Java source code into syntax colored HTML we use in the
> document generator system). Of course, you're free to write your own
> implementation for whatever transformations you need.
You can do something like this with VMs and tools :
#macro(thingy $foo)
Hello $foo.
#end
$tool.xmlEscape("#thingy('geir')")
Would send the string "Hello geir" to xmlEscape(String)
Of course, this isn't a stream interface....
>
> Maybe you'll like the idea enough to consider porting it...
>
You know us.... Monkey-see, Monkey-do!
;)
--
Geir Magnusson Jr.
Research & Development, Adeptra Inc.
geirm@adeptra.com
+1-203-247-1713
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: escaping xml characters
Posted by Attila Szegedi <sz...@freemail.hu>.
----- Original Message -----
From: "Geir Magnusson Jr." <ge...@adeptra.com>
To: <ve...@jakarta.apache.org>
Sent: 2002. május 31. 14:06
Subject: Re: escaping xml characters
>
> <thinking out loud>
>
> Rather than a single-purpose use of ":", I wonder if we can do some sort
of
> 'ReferenceAction'
>
> $foo:action
>
> type of syntax (I guess like the freemarker $foo?bar ?) but leave the
action
> completely defined by the application? Then you define an action event
> handler that gets invoked.
>
Well, FreeMarker has a feature for exactly this purpose and it's called
transform tools. These are essentially character stream filters. In FM to
perform XML escaping in a block you place an instance of
freemarker.template.utilities.XmlEscape in the context under some name (say,
"xmlEscape"). Then in the template you can use
<transform xmlEscape>
...
</transform>
to apply the transform to the encompassed block. The block itself can of
course contain any valid FTL construct, including even nested transforms. It
works much like the body-processing tags in JSP taglibs. There are stock
implementations for XML/HMTL escaping as well as some more exotic ones (like
one that transforms Java source code into syntax colored HTML we use in the
document generator system). Of course, you're free to write your own
implementation for whatever transformations you need.
Maybe you'll like the idea enough to consider porting it...
Attila.
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: escaping xml characters
Posted by Bill Burton <bi...@progress.com>.
Hello,
See below ...
"Geir Magnusson Jr." wrote:
>
> On 5/30/02 10:08 PM, "Jeff Schnitzer" <je...@infohazard.org> wrote:
>
> > Is there a way to get Velocity to automatically escape XML characters?
> >
> > I notice that it currently isn't doing so, and I don't see any
> > configuration keys for this. If I missed something, please enlighten me
> > and ignore the rest of this message :-)
> >
> > I'm hoping it can work something like the JSTL tags, which offers this
> > facility: <c:out value="${blah}" escapeXml="false"/> with a default of
> > true. Struts tags also automatically escape XML chars unless you
> > specify otherwise.
>
> >
> > I need to escape all velocity expressions unless I explicitly specify
> > otherwise. I'll propose that anyone else using velocity to build web
> > applications also needs this same facility, otherwise they are probably
> > vulnerable to CSS attacks. There was a long discussion of
> > cross-site-scripting vulnerabilities on Jakarta-general last year. (for
> > the reason it is not appropriate to try to escape data on input:
> > http://www.mail-archive.com/general@jakarta.apache.org/msg02200.html)
> >
> > I propose a velocity config key (runtime.escapexml?) that defaults to
> > false (for backwards compatibility). I also propose an additional
> > snippet of syntax, like $:blah, which inverts the xml escaping. I'm not
> > particular about the character or syntax, but it needs to be possible.
>
> Hm. I'll put the usual 'use a tool' argument aside for a second :) (Og use
> tool!)
>
> The event system was created by a request for the same thing - but for XML
> generation. Leon wanted a way to escape on insert into the stream for
> references.
>
> Could you use that?
>
> <thinking out loud>
>
> Rather than a single-purpose use of ":", I wonder if we can do some sort of
> 'ReferenceAction'
>
> $foo:action
>
> type of syntax (I guess like the freemarker $foo?bar ?) but leave the action
> completely defined by the application? Then you define an action event
> handler that gets invoked.
>
> This parallels the regular event handler, except it gives the designer
> template-level control over when the action is performed.
A variant to this would be a new block directive that lets one specify a
ReferenceAction affecting a block.
Another related idea would be a new #filter block directive which could be
used to filter everything until the corresponding #end and/or could
install a ReferenceAction active for that block. Of course, #filter's
could be nested ...
-Bill
>
> Another approach that might be interesting is to let you have some way of
> turning off the reference event stuff on a reference by reference basis...
>
> Hm
>
> </thinking out loud>
>
> --
> Geir Magnusson Jr.
> Research & Development, Adeptra Inc.
> geirm@adeptra.com
> +1-203-247-1713
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: escaping xml characters
Posted by Will Glass-Husain <wg...@forio.com>.
Nice idea! I think this would be useful.
I've hit this problem before, in an app that output large blocks of text.
I wrote a tool that (A) escaped XML characters and (B) converted carriage
returns into <br>. (Sometimes I needed one functionality, sometime both). But
the syntax was unwieldy.
It'd be nice to choose to do this on a reference by reference basis with some
built-in syntax.
WILL
Quoting "Geir Magnusson Jr." <ge...@adeptra.com>:
> On 5/30/02 10:08 PM, "Jeff Schnitzer" <je...@infohazard.org> wrote:
>
> > Is there a way to get Velocity to automatically escape XML
> characters?
> >
> > I notice that it currently isn't doing so, and I don't see any
> > configuration keys for this. If I missed something, please enlighten
> me
> > and ignore the rest of this message :-)
> >
> > I'm hoping it can work something like the JSTL tags, which offers
> this
> > facility: <c:out value="${blah}" escapeXml="false"/> with a default
> of
> > true. Struts tags also automatically escape XML chars unless you
> > specify otherwise.
>
> >
> > I need to escape all velocity expressions unless I explicitly
> specify
> > otherwise. I'll propose that anyone else using velocity to build
> web
> > applications also needs this same facility, otherwise they are
> probably
> > vulnerable to CSS attacks. There was a long discussion of
> > cross-site-scripting vulnerabilities on Jakarta-general last year.
> (for
> > the reason it is not appropriate to try to escape data on input:
> >
> http://www.mail-archive.com/general@jakarta.apache.org/msg02200.html)
> >
> > I propose a velocity config key (runtime.escapexml?) that defaults
> to
> > false (for backwards compatibility). I also propose an additional
> > snippet of syntax, like $:blah, which inverts the xml escaping. I'm
> not
> > particular about the character or syntax, but it needs to be
> possible.
>
> Hm. I'll put the usual 'use a tool' argument aside for a second :) (Og
> use
> tool!)
>
> The event system was created by a request for the same thing - but for
> XML
> generation. Leon wanted a way to escape on insert into the stream for
> references.
>
> Could you use that?
>
> <thinking out loud>
>
> Rather than a single-purpose use of ":", I wonder if we can do some sort
> of
> 'ReferenceAction'
>
> $foo:action
>
> type of syntax (I guess like the freemarker $foo?bar ?) but leave the
> action
> completely defined by the application? Then you define an action
> event
> handler that gets invoked.
>
> This parallels the regular event handler, except it gives the designer
> template-level control over when the action is performed.
>
>
> Another approach that might be interesting is to let you have some way
> of
> turning off the reference event stuff on a reference by reference
> basis...
>
> Hm
>
> </thinking out loud>
>
>
> --
> Geir Magnusson Jr.
> Research & Development, Adeptra Inc.
> geirm@adeptra.com
> +1-203-247-1713
>
>
>
> --
> To unsubscribe, e-mail:
> <ma...@jakarta.apache.org>
> For additional commands, e-mail:
> <ma...@jakarta.apache.org>
>
>
------------------------------------
Will Glass-Husain <wg...@forio.com>
Forio Business Simulations
office: (415) 440-7500
mobile: (415) 235-4293
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: escaping xml characters
Posted by "Geir Magnusson Jr." <ge...@adeptra.com>.
On 5/30/02 10:08 PM, "Jeff Schnitzer" <je...@infohazard.org> wrote:
> Is there a way to get Velocity to automatically escape XML characters?
>
> I notice that it currently isn't doing so, and I don't see any
> configuration keys for this. If I missed something, please enlighten me
> and ignore the rest of this message :-)
>
> I'm hoping it can work something like the JSTL tags, which offers this
> facility: <c:out value="${blah}" escapeXml="false"/> with a default of
> true. Struts tags also automatically escape XML chars unless you
> specify otherwise.
>
> I need to escape all velocity expressions unless I explicitly specify
> otherwise. I'll propose that anyone else using velocity to build web
> applications also needs this same facility, otherwise they are probably
> vulnerable to CSS attacks. There was a long discussion of
> cross-site-scripting vulnerabilities on Jakarta-general last year. (for
> the reason it is not appropriate to try to escape data on input:
> http://www.mail-archive.com/general@jakarta.apache.org/msg02200.html)
>
> I propose a velocity config key (runtime.escapexml?) that defaults to
> false (for backwards compatibility). I also propose an additional
> snippet of syntax, like $:blah, which inverts the xml escaping. I'm not
> particular about the character or syntax, but it needs to be possible.
Hm. I'll put the usual 'use a tool' argument aside for a second :) (Og use
tool!)
The event system was created by a request for the same thing - but for XML
generation. Leon wanted a way to escape on insert into the stream for
references.
Could you use that?
<thinking out loud>
Rather than a single-purpose use of ":", I wonder if we can do some sort of
'ReferenceAction'
$foo:action
type of syntax (I guess like the freemarker $foo?bar ?) but leave the action
completely defined by the application? Then you define an action event
handler that gets invoked.
This parallels the regular event handler, except it gives the designer
template-level control over when the action is performed.
Another approach that might be interesting is to let you have some way of
turning off the reference event stuff on a reference by reference basis...
Hm
</thinking out loud>
--
Geir Magnusson Jr.
Research & Development, Adeptra Inc.
geirm@adeptra.com
+1-203-247-1713
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>