org.thymeleaf.exceptions.TemplateProcessingExcepti

Question

I have been using thymeleaf th:onclick attribute to call javascript function with parameters as below

th:onclick="|myFunction('${parameter1}')|"

But with thymeleaf 3.1.10 this has been removed. and they are suggesting to use th:data attribute.

I however found workaround on as below and both of them are working perfectly.

1. th:attr="onclick=|myFunction('${parameter1}')|"
2. th:onclick="@{myFunction('${parameter1}')}">

Now i am not sure if these workarounds are correct way to do things and if yes which one is the better way.

Answer 1

The first will work like you want -- however, you are bypassing the the security restriction and now your pages are vulnerable to javascript injection (which is the original reason this change was made).

The second one just plain doesn't work. It doesn't expand out the variable ${parameter1}, instead just encoding it as a url like this:

onclick="myFunction?$%7Bparameter1%7D"

You really should be doing it as shown on the page.

th:data-parameter1="${parameter1}" onclick="myFunction(this.getAttribute('data-parameter1'));"