Feature Proposal: ENCODE and URLPARAM Variables with new "moderate" encoding

Motivation

The type="safe" is the default mode for ENCODE and URLPARAM. It escapes some characters to reduce the chance of cross-site scripting attacks. With this, TWiki variables are escaped as well because the percent character is escaped.

This proposal adds a type="moderate" mode that acts like type="safe" but excludes the percent character. That way, %BR% and other TWiki variables function properly when added in a CommentPlugin comment box.

TWikibug:Item6276 (cannot specify percentBRpercent for newline value) currently fixes this issue by using type="off", which opens comment boxes to cross-site scripting attacks. I recommend to add type="moderate" mode, which is a relatively safe middle ground.

Description and Documentation

In VarENCODE add this:

In VarURLPARAM add this:

Examples

Impact

Implementation

-- Contributors: PeterThoeny - 2010-03-01

Discussion