HtmlHelper.cfc passes the functions minifyHtml() and encodeTrustedHtml() as Lambda Expressions to enhance inner local scoping (see code here at GitHub):
- IMPORTANT SECURITY NOTICE:
encodeTrustedHtml()MUST NOT be used to avoid XSS, because it only encodes unencoded characters of the inner HTML (within the body of tags). This function will accept any submitted HTML, JavaScript and Styles and output it as submitted(!) without encoding it for XSS mitigation. For XSS prevention of untrusted HTML you MUST continue to useencodeForHTML(),encodeForHTMLAttribute(),encodeForJavascript(),encodeFor...()respectively.- The Regex patterns are set to work with CFMLs default 'Perl' Regex-Engine
- When using
encodeTrustedHTML()always make sure to keep all the charsets among the stream "in sync". Having different charsets for templates, web charset, charset http headers, or resource charsets may have unpredictable wrong html-entities and characters.encodeTrustedHTML()is typically used when you have a fronted CMS with a HTML-Editor where you can manually add custom HTML to a database.- You get best performance when you use
minifyHtml()only once during the request flow, e.g. at the end of the CFML processing. A good location could be the Application.cfc at the end of theonRequest()function.
To test or watch the code running locally, you'll need CommandBox as dependency:
- Download the Repository as ZIP-File
- Unzip it
- Run
server.baton Windows orserver.shon MacOs/Linux- Wait for commandBox open the browser and load the page
I'm not taking anything for this but sharing with you. If you like/are using it, I kindly ask you to donate to the Lucee Organization to make this awesome cfengine even better:
Lucee Open Collective Donation ❤️
- Author: Andreas at Rhein Berg Digital, LinkedIn
- GitHub: cfml-htmlhelper
- Issues/Requests: cfml-htmlhelper issues
- License: MIT License
- Software : Lucee CFML Engine (GNU LGPL v2.1), CommandBox (GNU GPLv3), highlight.js (BSD 3-Clause License, Copyright (c) 2006, Ivan Sagalaev), normalize.css (MIT License, Copyright (c) Nicolas Gallagher and Jonathan Neal), github-fork-ribbon-css (MIT License, Copyright (c) 2013 Simon Whitaker)
- Imprint: Visit here
- Privacy Policy: Visit the hosters Site Policy and the authors