TYPO3 / Fluid

Fluid template rendering engine - Standalone version
GNU Lesser General Public License v3.0
153 stars 93 forks source link

[!!!][TASK] Throw exception for https namespaces #914

Closed s2b closed 1 month ago

s2b commented 1 month ago

One way to make custom ViewHelpers available in Fluid templates is to define them as xml namespaces. Fluid parses <html> tags in templates, extracts all XML namespaces relevant to Fluid and removes them from the resulting HTML output.

XML namespaces by convention are usually named as URIs. However, they are actually not "callable" URLs but rather unique identifiers. Thus, there is only one valid way to reference Fluid namespaces as xml namespaces: By using the following schema:

http://typo3.org/ns/$Vendor/$Package/ViewHelpers/

Using https instead of http is invalid. Previously, Fluid namespaces defined with https instead of http were ignored and kept in the resulting output. Now, we catch this bug in templates and throw an exception instead to make tempate authors aware that there is an issue in their template.

This change might break existing templates. However, this is easily avoidable by checking that no template in your project includes the following string:

https://typo3.org/ns/
s2b commented 1 month ago

Resolves #910