Home When do I need to encode with multiple codecs in Grails?
Reply: 0

When do I need to encode with multiple codecs in Grails?

user1816
1#
user1816 Published in July 16, 2018, 8:35 pm

I'm not clear of when (or if) I should use multiple Grails encodeAsXXX calls.

This reference says you need to encodeAsURL and then encodeAsJavaScript: http://grailsrocks.com/blog/2013/4/19/can-i-pwn-your-grails-application

It also says you need to encodeAsURL and then encodeAsHTML, I don't understand why this is necessary in the case shown but not all the time?

Are there other cases I should me using multiple chained encoders?

If I'm rendering a URL to a HTML attribute should I encodeAsURL then encodeAsHTML?

If I'm rendering a URL to a JavaScript variable sent as part of a HTML document (via a SCRIPT element) should I encodeAsURL, encodeAsJavaScript then encodeAsHTML?

If I'm rendering a string to a JavaScript variable sent as part of a HTML document should I encodeAsJavaScript then encodeAsHTML?

The official docs - https://docs.grails.org/latest/guide/security.html - don't show any examples of multiple chained encoders.

I can't see how I can understand what to do here except by finding the source for all the encoders and looking at what they encode and what's valid on the receiving end - but I figure it shouldn't be that hard for a developer and there is probably something simple I'm missing or some instructions I haven't found.

FWIW, I think the encoders I'm talking about are these ones:

https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/util/JavaScriptUtils.html#javaScriptEscape-java.lang.String-

https://docs.oracle.com/javase/7/docs/api/java/net/URLEncoder.html#encode(java.lang.String,%20java.lang.String)

https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/util/HtmlUtils.html#htmlEscape-java.lang.String- .

You need to login account before you can post.

About| Privacy statement| Terms of Service| Advertising| Contact us| Help| Sitemap|
Processed in 0.313343 second(s) , Gzip On .

© 2016 Powered by mzan.com design MATCHINFO