How to prevent Twirl from HTMLentities-encode strings in script scetion?

Question

I'm trying to embed JsonLd into my pages using Twirl, but for some reason the content gets HTMLentities-encoded.

My (twirl template) html looks like this:

@(jsonLd: String)(implicit config: play.api.Configuration)
@main() {
  <script type="application/ld+json">
    @jsonLd
  </script>
}

But when I look in the web browser I see something like: {"@type":"DataRecord","@context"... etc.

How can I prevent @jsonLd from getting encoded??

cbley · Accepted Answer · 2020-10-13 20:00:36Z

1

By default, all dynamic contents is encoded for security reasons to avoid some common attacks (XSS). See here: https://www.playframework.com/documentation/2.8.x/ScalaTemplates#Escaping

You can use

@Html(jsonLd)

answered Oct 13, 2020 at 20:00

cbley

4,6181 gold badge20 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1