This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch feature/WW-5695-html5-constraint-validation in repository https://gitbox.apache.org/repos/asf/struts.git
commit d0d0ce49ff88d34e5064fbdba6e1a18a670c9025 Author: Lukasz Lenart <[email protected]> AuthorDate: Mon Aug 24 23:48:14 2026 +0200 WW-5695 docs(validation): drop the ?html builtin from the template guidance The design and plan both prescribed ${value?html} for the constraints template. That is a parse error in this repo: FreemarkerManager sets ENABLE_IF_DEFAULT_AUTO_ESCAPING_POLICY with HTMLOutputFormat, so values are escaped by configuration and FreeMarker rejects ?html as a double-escape. Zero templates in the tree use it. The escaping requirement itself stands and is easy to mistake for absent when reading the template, so both documents now say why there is no visible escape and warn against disabling auto-escaping for this file. Co-Authored-By: Claude Opus 5 <[email protected]> --- docs/superpowers/plans/2026-08-24-html5-constraint-validation.md | 8 ++++++-- .../specs/2026-08-24-html5-constraint-validation-design.md | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/superpowers/plans/2026-08-24-html5-constraint-validation.md b/docs/superpowers/plans/2026-08-24-html5-constraint-validation.md index 50a6a5668..2b2820a34 100644 --- a/docs/superpowers/plans/2026-08-24-html5-constraint-validation.md +++ b/docs/superpowers/plans/2026-08-24-html5-constraint-validation.md @@ -1593,10 +1593,14 @@ Expected: FAIL — `testRendersConstraintAttributes` finds no `minlength`, becau `core/src/main/resources/template/html5/constraints.ftl`, with the same `<#--` licence header used by the neighbouring html5 templates, then: ``` -<#if attributes.constraints??><#list attributes.constraints as attributeName, attributeValue> ${attributeName}="${attributeValue?html}"<#rt/></#list></#if> +<#if attributes.constraints??><#list attributes.constraints as attributeName, attributeValue> ${attributeName}="${attributeValue}"<#rt/></#list></#if> ``` -The `?html` escape matters: `pattern` and the `data-msg-*` values are author-controlled strings that land inside an HTML attribute. +**Do not add a `?html` builtin — it is a parse error here.** `FreemarkerManager` sets +`ENABLE_IF_DEFAULT_AUTO_ESCAPING_POLICY` with `HTMLOutputFormat` (`FreemarkerManager.java:354-355`), so values +are already HTML-escaped by configuration and FreeMarker rejects `?html` as a double-escape. Zero templates in +this repo use it. The escaping is still load-bearing — `data-msg-*` values are OGNL-interpolated and can carry +user-submitted content — so never disable auto-escaping for this template. - [ ] **Step 4: Include it** diff --git a/docs/superpowers/specs/2026-08-24-html5-constraint-validation-design.md b/docs/superpowers/specs/2026-08-24-html5-constraint-validation-design.md index 8e7c5c7e3..afa58601f 100644 --- a/docs/superpowers/specs/2026-08-24-html5-constraint-validation-design.md +++ b/docs/superpowers/specs/2026-08-24-html5-constraint-validation-design.md @@ -254,7 +254,7 @@ deleted with it in 8.0.0. ### `html5/constraints.ftl` (new), included from `common-attributes.ftl` ```freemarker -<#if attributes.constraints??><#list attributes.constraints as k, v> ${k}="${v?html}"<#rt/></#list></#if> +<#if attributes.constraints??><#list attributes.constraints as k, v> ${k}="${v}"<#rt/></#list></#if> ``` Including it from `common-attributes.ftl` means every `html5` input picks it up without per-template edits.
