com.google.template.soy.parsepasses.contextautoesc

Class ContextualAutoescaper

java.lang.Object

com.google.template.soy.parsepasses.contextautoesc.ContextualAutoescaper

public final class ContextualAutoescaper
extends Object

Inserts directives into print commands by looking at the context in which a print appears, and derives templates and rewrites calls so that each template is entered only in contexts consistent with its escaping conventions. E.g. it will rewrite {template example autoescape="contextual"} <p>Hello, {$world}!</p> {/template} to {template example autoescape="contextual"} <p>Hello, {$world |escapeHtml}!</p> {/template}

Constructor Summary

Constructors

Constructor and Description
ContextualAutoescaper(Iterable<? extends String> autoescapeCancellingDirectives, Map<? extends String,? extends SanitizedContent.ContentKind> sanitizedContentOperators, ErrorReporter errorReporter)

Method Summary

Modifier and Type	Method and Description
List<SlicedRawTextNode>	getSlicedRawTextNodes() Maps ranges of text-nodes to contexts so that later parse passes can add attributes or elements.
Context	getTemplateEndContext(String templateName) Null if no typing has been done for the named template, or otherwise the context after a call to the named template.
List<TemplateNode>	rewrite(SoyFileSetNode fileSet) Rewrites the given Soy files so that dynamic output is properly escaped according to the context in which it appears.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ContextualAutoescaper

public ContextualAutoescaper(Iterable<? extends String> autoescapeCancellingDirectives,
                             Map<? extends String,? extends SanitizedContent.ContentKind> sanitizedContentOperators,
                             ErrorReporter errorReporter)

Parameters:

autoescapeCancellingDirectives - The Soy directives that cancel autoescaping (see SoyPrintDirective.shouldCancelAutoescape()).

sanitizedContentOperators - Maps print directive names to the content kinds they consume and produce.

Method Detail

rewrite

public List<TemplateNode> rewrite(SoyFileSetNode fileSet)
                           throws SoyAutoescapeException

Rewrites the given Soy files so that dynamic output is properly escaped according to the context in which it appears.

Parameters:

fileSet - Modified in place.

Returns:

Extra templates which were derived from templates under fileSet and which must be compiled with fileSet to produce a correct output. See DerivedTemplateUtils for an explanation of these.

Throws:

SoyAutoescapeException - If it is impossible to statically determine the context of portions of templates. It is not possible to decide what to do with $x in: <script>{if $condition}</script>{/if} alert('Is this script or text? {$x}'); //<textarea><script></script><textarea></textarea>

getTemplateEndContext

public Context getTemplateEndContext(String templateName)

Null if no typing has been done for the named template, or otherwise the context after a call to the named template. Since we derive templates by start context at the call site, there is no start context parameter.

Parameters:

templateName - A qualified template name.

getSlicedRawTextNodes

public List<SlicedRawTextNode> getSlicedRawTextNodes()

Maps ranges of text-nodes to contexts so that later parse passes can add attributes or elements.