tag body as unescaped xml

• Key: JELLY-66
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Major
• Assignee: dion gillard
• Reporter: Knut Wannheden
• Component/s: core / taglib.core
• Fix Version/s: 1.0-beta-4

Description

(I've reported this problem to commons-user before. See thread "[jelly] body as unescaped xml".)

The following snippet exposes the problem:

<j:set var="foo">
<foo/>
</j:set>
${foo}

I expected the output to be "<foo></foo>" (or "<foo/>") but it is actually "<foo></foo>".

The problem is that there is no way to control this behaviour. The reason is that the factory methods of XMLOutput by default return an instance which escapes body text with XML entities (as in the example). In many applications this makes sense, but ss Jelly is primarily a tool to manipulate XML, I think the default should be not to escape XML. (Also read the discussion in http://www.mail-archive.com/[e-mail]/msg02750.html.)

In the example the variable "foo" actually gets assigned the String value "<foo></foo>", which is escaped when it's dereferenced using "${foo}". The question is whether the value should really be a String. Shouldn't it really be XML?

Comments

[peter royal]

I would propose a new tag that captures its body as XML.

[Knut Wannheden]

I suppose this is really two problems then. The first being that <j:set> sets the value of the variable to a String value even though the body is XML. And the second being that XMLOutput by default escapes text using XML entities.

But of course these two are linked to each other. If just one of them is fixed my problem is solved.

The first one probably requires some thought and should maybe be implemented using a new tag as you say.

The second one is really easy to solve, and makes a lot of sense IMHO. Also it makes a workaround for the first problem possible:

<j:set var="foo">
<foo/>
</j:set>
<xml:parse var="foo">
${foo}
</xml:parse>

Of course that would already be possible now, but you would have to do the second step like this:

<xml:parse var="foo" text="${foo}"/>

Now that these two don't behave the same is really ugly.

[Knut Wannheden]

Also note that changing XMLOutput's default behaviour would also make the patch of JELLY-55 unnecessary. Or should there maybe be a "global" attribute "escapexml" to control this? Much like the "trim" attribute.

[dion gillard]

Yep, escaping XML keeps biting Jelly.

At some point in the past the default was the opposite....

I'd much prefer it didn't escape XML.

[Knut Wannheden]

Patch for XMLOutput. This patch changes the default behaviour of XMLOutput in such a way that the default static factory methods create instances which don't escape text using XML entities.

[dion gillard]

There are methods in XmlOutput to create XmlOutput with escaping turned on.

I'd rather we look at using those than brute force.

[dion gillard]

You can use the core:file tag for this as well.

[dion gillard]

Do we have tests for the set tag and it's encode attribute?

[dion gillard]

I've committed a change that will allow us to switch the default easily.

My take is that we switch it to false, so that XML text is not escaped as the default.

If someone wants escaping on, they can easily create an XMLOutput with it on using the
createXMLOutput(Writer writer, boolean escapeText) or createXMLOutput(OutputStream out, boolean escapeText)

methods.

[Knut Wannheden]

If I understand this last comment correctly, then the decision is to now apply the patch I submitted just about a year ago. Is this correct?

[dion gillard]

Yep. It's taken that long to get people interested

[dion gillard]

Made the default not to escape. Please re-open if this is an issue