Currently GMT applies HTML escapes at different stages of the code
When ingesting data
When outputting data from the API
In the JS frontend
The two former calls are all funneled through html_escape_multi in the main.py and api_helpers.py.
The latter is done in native JS code through the function escapeString.
In JS land it often occurs that we have arguments that need to be checked on every call. For instance when we ingest URL params.
However in the API / backend side it is unneded to do the escaping on every call. It should be streamlined to only happen on ingest or at least the transformed output should be cached indefinitely if a clean DB is preferred.
Currently GMT applies HTML escapes at different stages of the code
The two former calls are all funneled through
html_escape_multiin themain.pyandapi_helpers.py.The latter is done in native JS code through the function
escapeString.In JS land it often occurs that we have arguments that need to be checked on every call. For instance when we ingest URL params.
However in the API / backend side it is unneded to do the escaping on every call. It should be streamlined to only happen on ingest or at least the transformed output should be cached indefinitely if a clean DB is preferred.