Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Trusted URIs aren't composable #203

Open
sgammon opened this issue Mar 20, 2020 · 1 comment
Open

Trusted URIs aren't composable #203

sgammon opened this issue Mar 20, 2020 · 1 comment

Comments

@sgammon
Copy link

sgammon commented Mar 20, 2020

Consider the following template:

{template .asset_link kind="trusted_resource_uri" visibility="private"}
  {@param uri: trusted_resource_uri}  /** URI postfix to apply. */
  {@inject? cdn_prefix: trusted_resource_uri}  /** CDN prefix to use, if applicable. */

  {if isNonnull($cdn_prefix)}
    {$cdn_prefix}{$uri}
  {else}
    {$uri}
  {/if}
{/template}

From the type names, it's implied that this would work and skip escaping, because, even though the trusted_resource_uri we're returning isn't a constant itself, per se, the two items it is composed of are trusted constants.

Instead, however, invoking this template returns something like:
https://cdn_prefix.com/some%2Fescaped%2Furl%2Fhere.css

Which obviously doesn't work. In the above example, the CDN prefix is essentially just a display detail, hence why we want to keep it in Soy. Because there isn't a way to compose string types into trusted_resource_uri types (for good reason) from within Soy itself, is there any way to accomplish the above smoothly?

In our case, uri is itself already a trusted_resource_uri when Soy begins the render process. So, composing these two URIs is a rather challenging task, even from pure Java, because we'd have to disassemble/re-assemble the TrustedResourceUriProto, which is also verboten.

@iteriani
Copy link
Contributor

Sorry I dropped this (busy things ahead). This seems like a corner case with a workaround (a soy function), we likely won't get around to something like this until we finish the Soy formatter

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants