oscerd commented on PR #27721:
URL: https://github.com/apache/camel/pull/27721#issuecomment-6165155891
Thanks — this is the deeper issue, and you're right that the first cut only
protected a direct `{$tag}`. Pushed `f82cb8c` which extends the binding and
documents the rest honestly.
**Binding now recurses** (`toLiteralValue`): `String`/`CharSequence`
(StringBuilder etc. via `toString()`), `Map`, `Collection` and `Object[]`,
still gated on `isSimple()` so tag-free data keeps its filter behaviour.
Verified against chunk-templates 3.6.2:
- StringBuilder body `{$body}` → literal ✓
- List-of-Maps (unmarshalled JSON) `{% loop in $body as x %}{$x.k}{% endloop
%}` → literal ✓
- `{$body|slice(0:5)}` on `Hello World` → `Hello` (filters intact) ✓
**One correction on the loop case:** recursing into collections fixes a list
**of maps** (the `{$x.k}` value stays a Snippet), but it does **not** fix a `{%
loop %}` over a list of raw **strings** printed with `{$x}` — Chunk
re-stringifies the loop variable, so the wrapped item is re-parsed. I couldn't
close that from the binding side, so I've grouped it with the other render-time
re-parse paths.
**Documented residual** (component doc `Security` section + 4.24 guide):
filter output (`{$body|trim}`), bean string properties (`{$body.name}`,
`{$exception.message}`), and loop-bound string items are still parsed — Chunk
re-parses any string it produces at render time, which the binding can't
intercept. Guidance added: keep untrusted data to direct `{$tag}` output, don't
pass it through filters/bean properties/loops.
Tests added for StringBuilder and List-of-Maps; full suite (21) +
`-Psourcecheck` green. `fixVersion` 4.24.0 will be set on merge; if backported,
I'll add the note to the 4_22/4_18 guides on `main` then.
Re-requesting review.
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
