Menu
I have a java method, that takes a few strings. This method needs to be called from a Velocity Template. However, the strings are too complex, with lots of single quotes, double quotes and commas as well. As a result merge is failing. Is there a way to escape quotes in Velocity?
316
Velocity allows for explicit escaping of References and Directives using the \ (backslash) character. If the character following the \ would start a new directive or reference, then this character is output verbatim. This can lead to some unexpected behaviour, especially with directives.
Alternatively, you can use a backslash \ to escape the quotation marks.
“Double quotes 'escape' double quotes“ When using double quotes "" to create a string literal, the double quote character needs to be escaped using a backslash: \" .
Velocity and FreeMarker are two templating languages that can both be used as view technologies within Spring MVC applications. The languages are quite similar and serve similar needs and so are considered together in this section.
Rendering data from untrusted sources in Velocity templates can result in XSS vulnerabilities if the data has not been html encoded. As of JIRA 5.1, we have introduced the ability to opt into automatic HTML escaping for all references
In order to avoid escaping when a specific reference is evaluated you only need to append the string "html" at the end of the reference. For instance:
Html escaping will not be applied when it is evaluated, the output will be: This should not be escaped, therefore rendering in red colour. In order to avoid escaping when a specific method call is evaluated you only need to append the string "html" at the end of the method's name, or alternatively, annotate the method as @HtmlSafe.
It depends on which version of Velocity you're using. Velocity 1.7 has clear rules for escaping quotes: just double the same type of quotes used to wrap the string:
$object.callMethod('Let''s have fun with "quotes"', "Let's have fun with ""quotes""") Prior to that, there were some fuzzy rules with backslash escapes that didn't always work as expected.
99
See the Velocity Escape Tool:
https://velocity.apache.org/tools/2.0/apidocs/org/apache/velocity/tools/generic/EscapeTool.html
45
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
