Encoding for a text area

[Mat Jaggard]

I have a template which contains

<textarea ...>${contents}</textarea>

However I'm finding that any newlines have a <br/> added. How do I
prevent this but still encode characters like "<" so that the page
can't be hacked?

[Erdinc Yilmazel]

Interesting, I don't remember converting new line characters to <br/> tags in the Escape filter but apparently I am doing so: https://github.com/erdincyilmazel/Cambridge/blob/master/cambridge-core/src/main/java/cambridge/runtime/EscapeFilter.java

I don't think this should be done by default. I can work on a patch sometime today and make this behavior optional.

What do other people think about his possible change?

Erdinc

[Mat Jaggard]

Just as an FYI, since I'm using Commons Lang in other places, I've
changed to doing the encoding in my Java code using
org.apache.commons.lang3.StringEscapeUtils.escapeHtml4() which also
encodes other HTML entities in addition to &quot;, &amp;, &lt;, &gt;
and &#xxxx;

Mat.

[Erdinc Yilmazel]

Yeah that probably is a better alternative to built in escape logic in Cambridge. I want to keep external dependencies of Cambridge to minimal so I didn't use any libraries like apache commons for core functionality.