Process Thymeleaf variable as HTML code and not text

Question

I'm using Thymeleaf to process html templates, I understood how to append inline strings from my controller, but now I want to append a fragment of HTML code into the page.

For example, lets stay that I have this in my Java application:

String n="<span><i class=\"icon-leaf\"></i>"+str+"</span> <a href=\"\"></a>\n";

final WebContext ctx = new WebContext(request, response, 
                                      servletContext, request.getLocale());
ctx.setVariable("n", n);

What do I need to write in the HTML page so that it would be replaced by the value of the n variable and be processed as HTML code instead of it being encoded as text?

Mahozad · Accepted Answer · 2018-07-17 10:01:55Z

169

You can use th:utext attribute that stands for unescaped text (see documentation). Use this with caution and avoid user input in th:utext as it can cause security problems.

<div th:remove="tag" th:utext="${n}"></div>

edited Jul 17, 2018 at 10:01

Mahozad

26.4k19 gold badges163 silver badges200 bronze badges

answered Apr 25, 2014 at 13:21

michal.kreuzman

12.4k10 gold badges61 silver badges70 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

theINtoy Over a year ago

Updated link to v3 thymeleaf.org/doc/tutorials/3.0/…

Dhiraj Gandhi Over a year ago

Does this work with Apache FOP as well while rendering a PDF. Because i don't see any change adding utext tag.

Jackson Bray Over a year ago

I tried this but it literally throws an error for every HTML tag I use saying it needs a closing tag, even when the closing tag is present.

wi2ard Over a year ago

Important thing to note: using utext makes you vulnerable to cross site scripting attacks. An attacker can store malicious html in your n variable that would get executed every time the page is rendered on your user's browser. See owasp.org/index.php/…

michal.jakubeczy · Accepted Answer · 2020-11-12 14:08:19Z

21

If you want short-hand syntax you can use following:

[(${variable})]

Escaped short-hand syntax is

[[${variable}]]

but if you change inner square brackets [ with regular ( ones HTML is not escaped.

Example within tags:

<div>
    [(${variable})]
</div>

edited Nov 12, 2020 at 14:08

answered Nov 12, 2020 at 14:01

michal.jakubeczy

9,7771 gold badge71 silver badges84 bronze badges

Comments

metadevj · Accepted Answer · 2023-02-23 04:53:56Z

1

Staring with Thymeleaf 3.0 the html friendly tag would be:

<div class="mailbox-read-message" data-th-utext="*{body}">

answered Feb 23, 2023 at 4:53

metadevj

672 silver badges4 bronze badges

Collectives™ on Stack Overflow

Process Thymeleaf variable as HTML code and not text

3 Answers 3

4 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related