开发者

Why doesn't grails.views.default.codec default to "html"?

The Grails Config.groovy setting grails.views.default.codec specifi开发者_高级运维es the default codec used to encode data within ${...} in Grails views.

This config setting can take any of the values none (no filtering required), html (to avoid XSS-attacks) and base64 (has no real-world use-case that I know of).

The Grails default is none (no filtering).

Questions:

  • Are there any compelling technical reasons not to use the safer option "html"?
  • When do you choose to go with the default option of "none" in your Grails projects?


A question on similar topic here.. I don't claim big expertise on this, but I imagine. Why it's not html by default is strange to me. I found GRAILS-2945, where this was proposed but ultimately rejected, without too much explanation. There is also some more information in GRAILS-1827, when the issue was first implemented.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜