question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

[feature request] ability to default encode for html

See original GitHub issue

I post it in #137 earlier, but it is closed.

@xoofx does this being supported now ?

I know scriban may not only output html, so make it like razor may not an reasonable change, but we should open this ability, because we need {{ $myHtml | raw}} when we make it default to Encoded html.

we can add an IRawContent like razor’s IHtmlContent , with that we can add the raw filters as an build-in filter then we add an option Func<string,IHtmlContent> OutputAction , then we can happy coding.

TemplateContext  context = GetTemplateContext();
// the default OutputAction is   str=> new RawContent(str);

context.OutputAction = str=> new RawContent(WebUtility.HtmlEncode(str)); //default for html

// then renderContent
<div class="article-content">{{ model.content | raw }}</div>

and the buildin raw filter with C# implement

IRawContent Raw(string str)
{
    return new RawContent(str);
}

that way we can be safe for both the default and the changed encoded output.

and we default for JavaScript too

context.OutputAction = str=>new RawContent(JavaScriptEncoder.Default.Encode(str));

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Comments:11 (6 by maintainers)

github_iconTop GitHub Comments

1reaction
xoofxcommented, Oct 29, 2021

that’s means no build-in raw filter in scriban , and will only exists in custom context.

Why? You can do it in your own project. I don’t understand why you couldn’t write a raw filter. You can create your own function. Introduce your RawContent struct, override TemplateContext.Write and it will work.

Your requirement is very specific. It seems that you try to apply the design of Razor into Scriban, but you can do it internally in your own project if you want by extending Scriban.

0reactions
matteocontrinicommented, Aug 2, 2023

Right, but overriding TemplateContext.Write can be used exactly for this kind of scenario:

    public class MyTemplateContext : TemplateContext {
        public override TemplateContext Write(SourceSpan span, object textAsObject)
            => base.Write(span, textAsObject is string text ? WebUtility.HtmlEncode(text) : textAsObject);
    }

For anyone trying this solution and finding out it doesn’t work: make sure you override WriteAsync if you’re using asynchronous template rendering.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Ability to set encoding mode · Issue #137 · scriban/ ...
Being able to set the default encoding mode, sets up the ability to set custom encoding modes as a developer.
Read more >
New <%: %> Syntax for HTML Encoding Output in ASP.NET 4 ...
Today's post covers a small, but very useful, new syntax feature being introduced with ASP.NET 4 – which is the ability to automatically...
Read more >
HTML encoding issues - "Â" character showing up instead ...
Thank you! This did the trick. I see in the request/response the file (in my case, ASPX) was encoded as UTF-8. Notepad++ had...
Read more >
Cross Site Scripting Prevention Cheat Sheet
This is where Output Encoding and HTML Sanitization are critical. OWASP are producing framework specific cheatsheets for React, Vue, and Angular.
Read more >
AES and html encoded string comes wrong out of querystring
In our code we encrypt strings that are to be used in a link. The encoded base64 string is then html encoded and...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found