question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Is there a way to disable html escaping globally?

See original GitHub issue

Some projects like ansible and stackstorm use template engines on YAML data streams. In this case the {{ variable }} is used without escaping. Requiring {{{ variable }}} or {{& variable }} is unfamiliar to most folks. It would be nice to have a global default escaping mode where the default is HTML but an option would be None.

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Comments:5

github_iconTop GitHub Comments

3reactions
dutekvejincommented, Oct 27, 2019

Hi,

I would like to re-open this issue, as adding & token to all variables in projects that doesn’t requires HTML escaping is too much.

Right now I’m monkey-patching it 😕

chevron.renderer._html_escape = lambda string: string

But it would be nice to have more convenient way of doing this eg. passing custom escaper to render function, setting bool flag globally, passing bool flag to render function

If this is feasible, I’m willing to submit PR?

0reactions
papadeltasierracommented, Oct 19, 2022

Adding my support for a global (or parameter) to disable the HTML escaping. I have a use case where I am emulating another system uses the same syntax for {{ name }} to allow variable expansion but sometimes requires escaping and sometimes not. The system knows when to escape, or not, but there is no easy way for me to stop this in chevron without the monkey-patching above. Perhaps a new option on render?

Read more comments on GitHub >

github_iconTop Results From Across the Web

Mustache: Globally disable html escaping? - Stack Overflow
It's actually pretty simple. Mustache offers the possibility to override the escape function. This allows you to disable ...
Read more >
Spring Misconfiguration: HTML Escaping Disabled
Disabling the automatic escaping for HTML context in Spring tags may lead to the application being vulnerable to Cross-Site Scripting attacks.
Read more >
10.1. Preventing Cross Site Scripting Vulnerabilities
URLs require multiple types of escaping. This typically involves URL-escaping in addition to either HTML-escaping or JavaScript-escaping. There are many special ...
Read more >
Disable output escaping in transformations - Microsoft Learn
This step-by-step article describes how to disable output escaping of characters such as < and > in an XML style sheet transformation.
Read more >
Escape HTML (instance security hardening)
Use the glide.ui.escape_html_list_field property to force HTML escapes for HTML fields in a list view. HTML is one of the types that can...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found