Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SUGGESTION: Allow encodeAs attribute on sec: taglib tags #638

Open
U47 opened this issue Jun 3, 2021 · 0 comments
Open

SUGGESTION: Allow encodeAs attribute on sec: taglib tags #638

U47 opened this issue Jun 3, 2021 · 0 comments

Comments

@U47
Copy link

U47 commented Jun 3, 2021

Currently, it appears all the tags in the sec: taglib very explicitly call encodeAsHTML() on any output they return.
https://github.com/grails-plugins/grails-spring-security-core/blob/071b036101fc2a20f71816ece9fc603caff74a80/plugin/grails-app/taglib/grails/plugin/springsecurity/SecurityTagLib.groovy#L124

There are uses for having the tags return results in other encodings. For example, returning an MD5 hash of the logged-in user's email field to send direct in a Gravatar image link. Or even returning as raw so that the hash could then be computed manually on a non-HTML encoded email address (which changes the @ to an HTML entity).

Because the tags are explicitly handling the encoding, using raw() doesn't help—the output has already been encoded by the time raw() can get it. The canned Grails tags (g:) supposedly (according to documentation) support an encodeAs attribute to override the default encoding. That could also be an option.

For your consideration. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant