{"action":"created","issue":{"url":"https://api.github.com/repos/silverstripe/silverstripe-framework/issues/3924","labels_url":"https://api.github.com/repos/silverstripe/silverstripe-framework/issues/3924/labels{/name}","comments_url":"https://api.github.com/repos/silverstripe/silverstripe-framework/issues/3924/comments","events_url":"https://api.github.com/repos/silverstripe/silverstripe-framework/issues/3924/events","html_url":"https://github.com/silverstripe/silverstripe-framework/pull/3924","id":58526982,"number":3924,"title":"NEW Always use default_cast","user":{"login":"dhensby","id":563596,"avatar_url":"https://avatars.githubusercontent.com/u/563596?v=3","gravatar_id":"","url":"https://api.github.com/users/dhensby","html_url":"https://github.com/dhensby","followers_url":"https://api.github.com/users/dhensby/followers","following_url":"https://api.github.com/users/dhensby/following{/other_user}","gists_url":"https://api.github.com/users/dhensby/gists{/gist_id}","starred_url":"https://api.github.com/users/dhensby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dhensby/subscriptions","organizations_url":"https://api.github.com/users/dhensby/orgs","repos_url":"https://api.github.com/users/dhensby/repos","events_url":"https://api.github.com/users/dhensby/events{/privacy}","received_events_url":"https://api.github.com/users/dhensby/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/silverstripe/silverstripe-framework/labels/change/major","name":"change/major","color":"f7c6c7"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/silverstripe/silverstripe-framework/milestones/7","html_url":"https://github.com/silverstripe/silverstripe-framework/milestones/4.0","labels_url":"https://api.github.com/repos/silverstripe/silverstripe-framework/milestones/7/labels","id":598745,"number":7,"title":"4.0","description":"Things we would like to see in 4.0 but are too large/break too much for a 3.x release.","creator":{"login":"simonwelsh","id":125915,"avatar_url":"https://avatars.githubusercontent.com/u/125915?v=3","gravatar_id":"","url":"https://api.github.com/users/simonwelsh","html_url":"https://github.com/simonwelsh","followers_url":"https://api.github.com/users/simonwelsh/followers","following_url":"https://api.github.com/users/simonwelsh/following{/other_user}","gists_url":"https://api.github.com/users/simonwelsh/gists{/gist_id}","starred_url":"https://api.github.com/users/simonwelsh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simonwelsh/subscriptions","organizations_url":"https://api.github.com/users/simonwelsh/orgs","repos_url":"https://api.github.com/users/simonwelsh/repos","events_url":"https://api.github.com/users/simonwelsh/events{/privacy}","received_events_url":"https://api.github.com/users/simonwelsh/received_events","type":"User","site_admin":false},"open_issues":10,"closed_issues":1,"state":"open","created_at":"2014-03-15T20:48:10Z","updated_at":"2015-03-10T01:10:45Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-02-22T23:21:56Z","updated_at":"2015-03-19T21:56:59Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/silverstripe/silverstripe-framework/pulls/3924","html_url":"https://github.com/silverstripe/silverstripe-framework/pull/3924","diff_url":"https://github.com/silverstripe/silverstripe-framework/pull/3924.diff","patch_url":"https://github.com/silverstripe/silverstripe-framework/pull/3924.patch"},"body":"This is the start of some work to make `ViewableData` always use the `defaul_cast` to ensure that template escaping is secure by default.\r\n\r\nAt the moment this solution hasn't addressed the following issues specifically:\r\n\r\n1. Setting cast of fields on object instances (eg: creating an ArrayData and setting a custom cast)\r\n2. Dealing with setting default_cast higher up the inheritance chain\r\n\r\nThis patch effectively deprecates the `$forceObject` parameter of ViewableData::obj() as an object is now permanently returned under the `default_cast` if another casting rule is not specified.\r\n\r\nDecision that need to be made:\r\n\r\n0. Should this behaviour even happen? Is it desirable? Most importantly, is it any safer?\r\n1. Should default_cast be overridden by definitions on descendant classes?\r\n2. Should default_cast on descendent classes only override the setting for the fields/functions on THAT class? (eg: a default_cast on `MyClass` can only override a function on `MyClass` - similar to `allowed_actions`)\r\n\r\n\r\nTodo:\r\n\r\n- Re-write / fix broken tests (in `ViewableDataTest`)\r\n- Fix test failures everywhere else"},"comment":{"url":"https://api.github.com/repos/silverstripe/silverstripe-framework/issues/comments/83773971","html_url":"https://github.com/silverstripe/silverstripe-framework/pull/3924#issuecomment-83773971","issue_url":"https://api.github.com/repos/silverstripe/silverstripe-framework/issues/3924","id":83773971,"user":{"login":"sminnee","id":59968,"avatar_url":"https://avatars.githubusercontent.com/u/59968?v=3","gravatar_id":"","url":"https://api.github.com/users/sminnee","html_url":"https://github.com/sminnee","followers_url":"https://api.github.com/users/sminnee/followers","following_url":"https://api.github.com/users/sminnee/following{/other_user}","gists_url":"https://api.github.com/users/sminnee/gists{/gist_id}","starred_url":"https://api.github.com/users/sminnee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sminnee/subscriptions","organizations_url":"https://api.github.com/users/sminnee/orgs","repos_url":"https://api.github.com/users/sminnee/repos","events_url":"https://api.github.com/users/sminnee/events{/privacy}","received_events_url":"https://api.github.com/users/sminnee/received_events","type":"User","site_admin":false},"created_at":"2015-03-19T21:56:59Z","updated_at":"2015-03-19T21:56:59Z","body":"@tractorcow @hafriedlander @dhensby I think that we need to get this one ready for master as a priority, in order to better guard against XSS issues.\r\n\r\nRe: \"Perhaps if this is a 4.0 change the approach isn't radical enough?\" I think that it's better to do something now, then not do anything while waiting for something better. So I'd suggest we proceed with this change, and if we proceed with an RFC, well that's nice too. This is not a massively invasive change, it applies the same general principles that SSViewer had always had, it's more just a bit-too-invasive-for-a-minor-release, because it will fix \"bugs\" that developers will likely have relied on. ;-)"}}