Package org.apache.juneau.console

Class HtmlCardType

java.lang.Object
org.apache.juneau.console.HtmlCardType
All Implemented Interfaces:
CardTypeHandler
public final class HtmlCardType extends Object implements CardTypeHandler
The built-in html card type: markup-only (JSON5 bodies are E-25), with an optional body auto-captured as a <template data-card="{id}">. A bare html card (no body) emits an empty fragment — the shell paints an empty .jc-card and nothing more.
Trust boundary for src:

An html card in a page contract may instead name a src endpoint. The src must be a same-origin path (checked at page build, by PageCapture.addCard for FreeMarker and PageSpec cards and by CardTypeRegistry.toCard for lifted ones; the shell checks it again before the fetch). The shell fetches it and inserts the returned HTML as-is, unsanitized, the same trust level as footer.text. The endpoint must therefore be a trusted first-party route, must never be derived from request data, and must escape any data it embeds in the fragment.

A card that cannot guarantee that can opt in with "sanitize": true (or sanitize=true on <@card>, or CardSpec.sanitize(true)). The shell then rebuilds the fetched fragment through the views attribute-allowlist sanitizer, the one behind the SANITIZED_HTML detail format, so script, on* handlers, unsafe URLs and unlisted attributes are dropped. The page must load the views toolkit; without it the card fails closed with E-JS-8 and paints nothing. The flag only affects src cards, and the default is unchanged (unsanitized).

Example:

CardSource s = CardSource.create("html", "welcome") .title("Welcome") .body("<p>Hello!</p>") .templateSink(page::captureTemplate) .build(); JsonMap frag = new HtmlCardType().toFragment(s); // {"template":"welcome"}

Since:
10.0.0

  • Constructor Details

  • Method Details

    • type

      public String type()
      Description copied from interface: CardTypeHandler
      The type name this handler serves.
      Specified by:
      type in interface CardTypeHandler
      Returns:
      The type name; must match ^[a-z][a-z0-9-]{0,31}$ (E-21).

    • acceptedRoles

      public Set<String> acceptedRoles()
      An html card is markup: it takes only the shell's refresh / params roles.
      Specified by:
      acceptedRoles in interface CardTypeHandler
      Returns:
      The accepted role names, or null if unknown.

    • acceptedOps

      public Set<String> acceptedOps()
      An html card handles only the shell's refresh op.
      Specified by:
      acceptedOps in interface CardTypeHandler
      Returns:
      The handled op names, or null if unknown.

    • toFragment

      public JsonMap toFragment(CardSource source)
      Description copied from interface: CardTypeHandler
      Validates the authored card and returns its contract fragment.
      Specified by:
      toFragment in interface CardTypeHandler
      Parameters:
      source - The authored card (attributes plus body).
      Returns:
      The fragment merged flat onto the card's base keys; must not contain a reserved key (E-23).