Community
Q&A
Confluence
Questions
generalutil.htmlEncode deprecated - what to use instead (in a user macro)?

generalutil.htmlEncode deprecated - what to use instead (in a user macro)?

Hey GeneralUtil Javadocstates that GeneralUtil.htmlEncode is deprecated and to use HtmlUtil.htmlEncode instead. However, in user macros, there seems to be no $htmlUtil available. Is it used under a different name? Or are we supposed to use something else?

It is easy to forget that users can easily execute Javascript in somebody else's context if parameters are not escaped..

1 answer

Comments for this post are closed

Community moderators have prevented the ability to post new answers.

1 vote

This worked for me:

## @noparams
#set ( $htmlUtil = $content.class.forName("com.atlassian.confluence.util.HtmlUtil").getConstructor().newInstance() )
#set ( $htmlText = $htmlUtil.htmlEncode("&lt;p&gt; Test &lt;/p&gt;") )
$htmlText

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

While I appreciate your creativity (hence the upvote), I cannot mark this answer as accepted. There just has to be an "official" way to prevent XSS attacks via user macros.

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Thanks, I understand. However, I would have to say that there's nothing very "official" about user macros as they currently exist :)

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Was this helpful?

Thanks!

Confluence

Forums

Q&A

Community resources

Support

Top groups

Community resources

Support

Learn

Community resources

Support

Events

Community resources

Support

generalutil.htmlEncode deprecated - what to use instead (in a user macro)?

1 answer

Comments for this post are closed

Was this helpful?

Thanks!

TAGS

Atlassian Community Events