Summary of error handling

[Cantor, Scott]

On 6/10/14, 8:44 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:

>> I've only coded Velocity so far, since JSP views can always do anything
>> Velocity can much more easily.
>
>Another related question on the back of this is how are we handling HTML
>encoding in Velocity.

I expose the HTMLEncoder class as a request or view scoped variable in the
flow definition (or in the Spring error handling extension that generates
the view model), so it's trivial, just $encoder.encodeforHTML()

>Before I went on vacation I was looking at velocity and the taglibs.  What
>used to be done was an instance of the esapi encoder object was passed
>into
>the request (called "encoder") and velocity used that object to do the
>HTML
>encoding.  The encoding methods are now static and that broke a few error
>pages.  I fixed jsp (easy); I'm sure that there is a way to call static
>methods in Velocity but I couldn't see how and so I supressed the encoding
>in the velocity pages with a mental note to go back to this..

I don't think you can call them unless you have access to the class,
that's the nasty issue with Velocity relative to JSP. So you just have to
push in the class object itself.

>We may not need to encode for the error pages, but I'm pretty sure that we
>need to for stuff which comes in from the metadata.

Yes.

-- Scott