[
https://issues.apache.org/jira/browse/VELOCITY-618?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12638463#action_12638463
]
Byron Foster commented on VELOCITY-618:
---------------------------------------
It's actually worse then this. The way it stands, Velocity always tries to
evaluate a reference even if it is escaped. In fact, Velocity's escape
behavior is dependent on evaluating the reference. So, even \$abc will throw
an exception in strict mode. Any dollar sign in the template that can be
interpreted as a reference will need to be escaped with ${D}. yuck...
However, I'll take what I can get VELOCITY-623 is a separate patch for adding
this escape functionality.
One a side note, this escape behavior in any case seems in general to
borderlines on a bug. For example, the Alternator velocity tool has a side
effect, as pointed out, when calling toString(). It will certainly be
surprising to the developer that \$alt will change the value of $alt, and
there is no way to prevent this unless you use ${D}alt.
> Strict property and method references
> -------------------------------------
>
> Key: VELOCITY-618
> URL: https://issues.apache.org/jira/browse/VELOCITY-618
> Project: Velocity
> Issue Type: Improvement
> Components: Engine
> Reporter: Byron Foster
> Fix For: 1.5.1, 1.6
>
> Attachments: MacroAndVarEscape.patch,
> strictPropertyAndVariable_3.patch
>
>
> The given patch against trunk adds a new option 'runtime.references.strict'.
> When set to true, invalid property references will throw a
> InvalidMethodException. For example $foo.bar will throw an exception if the
> object contained in $foo has no such property as bar. Any kind of reference
> to bar will cause an exception including:
> #if(#foo.bar)
> #set($foo.bar = "junk")
> #set($foo.getBar())
> etc...
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
