org.thymeleaf.exceptions.TemplateProcessingException: Only variable expressions returning numbers or booleans are allowed in this context

Question

I have been using thymeleaf th:onclick attribute to call javascript function with parameters as below

th:onclick="|myFunction('${parameter1}')|"

But with thymeleaf 3.1.10 this has been removed. and they are suggesting to use th:data attribute.

I however found workaround on as below and both of them are working perfectly.

th:attr="onclick=|myFunction('${parameter1}')|"
th:onclick="@{myFunction('${parameter1}')}">

Now i am not sure if these workarounds are correct way to do things and if yes which one is the better way.

Metroids · Accepted Answer · 2019-01-16 21:20:37Z

12

The first will work like you want -- however, you are bypassing the the security restriction and now your pages are vulnerable to javascript injection (which is the original reason this change was made).

The second one just plain doesn't work. It doesn't expand out the variable ${parameter1}, instead just encoding it as a url like this:

onclick="myFunction?$%7Bparameter1%7D"

You really should be doing it as shown on the page.

th:data-parameter1="${parameter1}" onclick="myFunction(this.getAttribute('data-parameter1'));"

answered Jan 16, 2019 at 21:20

Metroids

20.6k4 gold badges49 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

org.thymeleaf.exceptions.TemplateProcessingException: Only variable expressions returning numbers or booleans are allowed in this context

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related