New grails 2.3.7 app is ignoring <%= %>

Question

I am writing a new grails 2.3.7 app and I'm trying to use <%= %> to avoid html encoding a domain class field.

For some reason grails is ignoring this and encoding the thing anyway.

As an example

<%="<h2>FOO</h2>"%>

Just renders as

<h2>FOO</h2>

and not as a level 2 header as expected.

Answer 1

This is not a bug but in fact Grails' automatic XSS attack prevention. See http://grails.org/doc/latest/guide/security.html#xssPrevention

What you want to do it mark the output as raw:

<%=raw("<h2>FOO</h2>")%>

However, note that this should be done with extreme care as you may put your application at risk of XSS attacks.