How to prevent velocity escape html

[grundic]

Hello!

I got a wired situation.

I'm creating plugin with web-panel and passing custom parameters to velocity template. In this parameters I got some html code.

So, the problem is: if I name my variable html then velocity renders my code as normal html. But if I name my variable, say, test then velocity escapes my html code and renders raw html.

Does someone encounter such a problem? I've read about <tt>ReferenceInsertionEventHandler</tt>, but I have't found it in Jira's source.

I don't mind to name my variable html, but I need several ones :-/

Thanks in advance

[Damian Nowak · Accepted solution]

Found in license-admin.vm file:

## Because these message may embed html tags that we don't want to be overescaped

#set($successMessageWithHtml = $successMessage)

[Charles Duffy]

Excellent -- appending WithHtml to a variable name does indeed prevent escaping. Thank you so much!

[David at David Simpson Apps]

Thanks Damian. Today I learnt something from the interwebs.

[Muhammad Ali]

this is really impossible to know that one should append WithHtml to variable name.

[grundic]

That is answers are for - you can find it here ;)

[Stefan Kleineikenscheidt _K15t_]

In fact this is also documented:

https://developer.atlassian.com/display/CONFDEV/Anti-XSS+documentation
https://developer.atlassian.com/display/CONFDEV/Enabling+XSS+Protection+in+Plugins

(just hard to find... ;-)

Cheers,
-Stefan

[Andrew S]

Actually you only need to append "Html" to the method name, the rest of the name is up to you.

[NielsJ]

Did you try marking your getters @HtmlSafe? That works in Confluence anyway...

[grundic]

Nope, it does't work - or, may be I can't find correct place for it.

I decided to make it via ajax call.

Thanks for reply, anyway!

[Damian Nowak]

It doesn't work for me either. I tried annotating my actions method with all these @HtmlSafe annotations: com.atlassian.velocity.htmlsafe.HtmlSafe, com.atlassian.confluence.velocity.htmlsafe.HtmlSafe, com.atlassian.templaterenderer.annotations.HtmlSafe.

[D. Brutscher]

Just tested it in Confluence 5.3.1, whether it works seems to depend on the way you reference your property from within Velocity:

@HtmlSafe
public String getScratch() {
    return scratch;
}

unescaped output: $action.getScratch()
unescaped output: $action.Scratch
escaped output: $Scratch

[grundic]

I've found a way to use @HtmlSafe.

public static class Unescaper {

    private static Unescaper singleton = new Unescaper();

    /**
     * Just returns the {@code text} parameter.  Because this method is annotated with {@code @HtmlSafe} the returned
     * value will not be escaped when it is inserted into the rendered template.
     *
     * @param text Text that we don't want escaped
     * @return {@code text} unmodified
     */
    @HtmlSafe
    public String html(Object text)
    {
      return text.toString();
    }

    public static Unescaper getSingleton()
    {
      return singleton;
    }

  }

Add instance of this static class to context:

paramsBuilder.add("unescaper", Unescaper.getSingleton());

And then you can use it in a velocity template like this:

$unescaper.html($some_variable)

If you, as me, encounter errors from maven, heres copy/paste solution to insert to pom.xml:

        <dependency>
            <groupId>com.atlassian.velocity.htmlsafe</groupId>
            <artifactId>velocity-htmlsafe</artifactId>
            <version>1.1.beta1</version>
            <scope>provided</scope>
            <!-- Working around http://jira.codehaus.org/browse/MNG-2742 - depends on version range [1.5,1.7) -->
            <exclusions>
                <exclusion>
                    <groupId>org.apache.velocity</groupId>
                    <artifactId>velocity</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

Hope, it will help someone.