open-forms icon indicating copy to clipboard operation
open-forms copied to clipboard

Service fetch with body needs to support template evaluation/variable injection

Open sergei-maertens opened this issue 2 years ago • 5 comments

The (JSON) body should be interpreted as a Django template where the DataMapping can be injected into.

This requires JSON/JS escaping on the input variables so that double quotes don't result in a broken body or a body with "script" injection. Possibly we need a separate django template instance for this with different auto-escape semantics/implementation rather than the HTML escaping it's doing out of the box.

sergei-maertens avatar Feb 13 '23 14:02 sergei-maertens