title: Grails Resources Plugin encoding issue with code = html
body: <p>According to Marc Palmer</p>
  
  <p><a href="http://grailsrocks.com/blog/2013/4/19/can-i-pwn-your-grails-application" rel="nofollow">Preventing XSS attacks</a></p>
  
  <blockquote>
    <p>In a nutshell, to protect your app from code injection XSS exploits
    you must:</p>
    
    <p>Set the default grails.views.default.codec in config to "HTML"</p>
  </blockquote>
  
  <p>OK.
  So if I have this below in my Config.groovy</p>
  
  <pre><code>grails.views.default.codec = "none"
  </code></pre>
  
  <p>And in my Controller, I add:</p>
  
  <pre><code>def afterInterceptor = { model -&gt;   
      model.headerJs = "alert('bingo for '+[$params.unitId]);"
  }
  </code></pre>
  
  <p>And in my GSP:</p>
  
  <pre><code>&lt;r:script disposition="head"&gt;${headerJs}&lt;/r:script&gt;
  </code></pre>
  
  <p>It works.  I see the expected javascript alert when I do View Source and I get my alert when the page serves.</p>
  
  <p>But, if in Config.groovy I apply the recommended change:</p>
  
  <pre><code>grails.views.default.codec = "html"
  </code></pre>
  
  <p>My GSP renders </p>
  
  <pre><code>&lt;script type="text/javascript"&gt;alert(&amp;#39;halooba for &amp;#39;+[1]);&lt;/script&gt;
  </code></pre>
  
  <p>which I can see is very secure.</p>
  
  <p>My goal with this app is to have custom JS snippets, various properties and other values stored for the customer in the Domain. These values would be entered by our Admins (not the customer).  Based on who invokes the page with an HTTP request, such as www.mydomain.com/ThisApp/?customerId=13423  (but an encoded customerId) I'd make calls to Services from my Controller to fetch the associated settings for the customer from the Domain and inject them into the GSP.</p>
  
  <p>I know that I can put JS and CSS into files and then use the Resources Plugin to bring them in properly, but I'm also looking at this method for specific customizations.</p>
  
  <p>So, to follow this security method, I either need to be able to unencode this, or I need to determine another method for including javascript into the GSP that does not encode it.</p>
  
  <p>Any suggestions?</p>
  
  <p>THANKS!</p>