Only variable expressions returning numbers or boo

I am trying to pass a value to my javascript function but that function call depends on a boolean variable. I had this working fine until I recently upgraded to thymeleaf security 5.

This is the code snippet.

<body th:onload="${timerEnabled} ? 'javascript:runTimer(\'' + ${timeRemaining} + '\');'">

timerEnabled has to be true for the function call to be done but thymeleaf now throws an exception as

org.thymeleaf.exceptions.TemplateProcessingException: Only variable expressions returning numbers or booleans are allowed in this context, any other datatypes are not trusted in the context of this expression, including Strings or any other object that could be rendered as a text literal. A typical case is HTML attributes for event handlers (e.g. "onload"), in which textual data from variables should better be output to "data-*" attributes and then read from the event handler.

How can I resolve this? Thank you.

标签： javascript html spring spring-boot thymeleaf

3条回答

Lonely孤独者°

2楼-- · 2020-08-09 07:37

I was able to have it working by using this approach

<body>

<script th:inline="javascript">
    /*<![CDATA[*/

    var flag = [[${timerEnabled}]]; // if timer should be included or not
    var timeRemaining = [[${timeRemaining}]]; // the time remaining.
    window.onload = function() {
        if(!flag)
            return; // Exit/Return if the variable is false
        runTimer(timeRemaining); // Call your favourite method if the variable is true
    };

    /*]]>*/
</script>

Any other approach such as suggested in the exception is appreciated.

0人赞添加讨论(0) 举报

我想做一个坏孩纸

3楼-- · 2020-08-09 07:38

Since Thymeleaf 3.0.10 they fixed a security-bug regarding unescaped code.

Try

<body th:onload="[[${timerEnabled}]] ? 'javascript:runTimer(\'' + 
[[${timeRemaining}]] + '\');'">

Or the recommended way:

<body th:data1="${timerEnabled}"
  th:data2="${timeRemaining}"
    th:onload="this.getAttribute('data1') ? javascript:runTimer(this.getAttribute('data2'));">

0人赞添加讨论(0) 举报

Luminary・发光体

4楼-- · 2020-08-09 07:42

Try it this way.

<body th:onload="${timerEnabled eq true} ? 'javascript:runTimer(\'' + ${timeRemaining} + '\');'">

If it doesn't work, you can also try using th:if.

<th:block th:if="${timerEnabled} eq true">
    <body th:onload="javascript:runTimer(\'' + ${timeRemaining} + '\');'">
    </body>
</th:block>
<th:block th:if="${timerEnabled} eq false">
    <body></body>
</th:block>

I know, the other version does look much better, but since it is not working, this one is not so bad. Of course, I wouldn't recommend adding it to your bode in this case.

What I find weird, is that I try your code it does work on my end. Who knows why you are getting that error.

0人赞添加讨论(0) 举报

Only variable expressions returning numbers or boo

采纳回答

编辑标签

举报内容

检举类型

检举原因

检举说明(必填)

打开微信“扫一扫”，打开网页后点击屏幕右上角分享按钮

付费偷看金额在0.1-10元之间