Thymeleaf 표현식

rootProject.name = 'thymeleaf-view-contracts'

plugins {
    id 'java'
}

group = 'board'
version = '1.0.0'

java {
    toolchain {
        languageVersion = JavaLanguageVersion.of(25)
    }
}

repositories {
    mavenCentral()
}

dependencies {
    implementation enforcedPlatform('org.springframework.boot:spring-boot-dependencies:4.1.1')
    implementation 'org.springframework.boot:spring-boot-starter-webmvc'
    implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
    implementation 'org.springframework.boot:spring-boot-starter-validation'
    implementation('org.jsoup:jsoup') {
        version { strictly '1.22.2' }
    }

    testImplementation enforcedPlatform('org.springframework.boot:spring-boot-dependencies:4.1.1')
    testImplementation 'org.springframework.boot:spring-boot-starter-webmvc-test'
    testImplementation('org.jsoup:jsoup') {
        version { strictly '1.22.2' }
    }
    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'

    constraints {
        implementation('org.thymeleaf:thymeleaf-spring6') {
            version { strictly '3.1.5.RELEASE' }
        }
        testImplementation('org.junit.jupiter:junit-jupiter') {
            version { strictly '6.0.3' }
        }
    }
}

tasks.withType(JavaCompile).configureEach {
    options.encoding = 'UTF-8'
    options.release = 25
    options.compilerArgs += ['-parameters']
}

tasks.named('test') {
    useJUnitPlatform()
}

package board.expression;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class ExpressionApplication {
    public static void main(String[] args) {
        SpringApplication.run(ExpressionApplication.class, args);
    }
}

package board.expression;

import java.time.LocalDate;
import java.util.Objects;

public interface PostQuery {
    PostSnapshot required(long id);

    record PostSnapshot(
            long id,
            String title,
            String plainContent,
            String markdownHtml,
            LocalDate publishedOn
    ) {
        public PostSnapshot {
            if (id <= 0) {
                throw new IllegalArgumentException("id must be positive");
            }
            Objects.requireNonNull(title, "title");
            Objects.requireNonNull(plainContent, "plainContent");
            Objects.requireNonNull(markdownHtml, "markdownHtml");
            Objects.requireNonNull(publishedOn, "publishedOn");
        }
    }
}

package board.expression;

import java.util.Objects;

public record PostPage(
        long id,
        String title,
        String plainContent,
        SanitizedHtml sanitizedContent,
        int characterCount,
        String publishedOn
) {
    public PostPage {
        if (id <= 0 || characterCount < 0) {
            throw new IllegalArgumentException("invalid post page");
        }
        Objects.requireNonNull(title, "title");
        Objects.requireNonNull(plainContent, "plainContent");
        Objects.requireNonNull(sanitizedContent, "sanitizedContent");
        Objects.requireNonNull(publishedOn, "publishedOn");
    }
}

package board.expression;

import java.time.format.DateTimeFormatter;

import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;

@Controller
public final class PostPageController {
    private static final DateTimeFormatter DATE =
            DateTimeFormatter.ofPattern("yyyy-MM-dd");

    private final PostQuery query;

    public PostPageController(PostQuery query) {
        this.query = query;
    }

    @GetMapping("/expression/posts/{id}")
    String detail(@PathVariable("id") long id, Model model) {
        var post = query.required(id);
        var content = post.plainContent();

        model.addAttribute("post", new PostPage(
                post.id(),
                post.title(),
                content,
                SanitizedHtml.fromUntrusted(post.markdownHtml()),
                content.codePointCount(0, content.length()),
                DATE.format(post.publishedOn())));
        return "expression/posts/detail";
    }
}

<!doctype html>
<html lang="ko" xmlns:th="http://www.thymeleaf.org">
<head>
  <meta charset="utf-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <title th:text="|${post.title} · 게시판|">게시판</title>
</head>
<body>
  <main>
    <article>
      <h1 th:text="${post.title}">제목</h1>
      <p id="plain-content" th:text="${post.plainContent}">본문</p>
      <section aria-labelledby="preview-heading">
        <h2 id="preview-heading">승인된 Markdown 미리보기</h2>
        <div id="safe-markdown"
             th:utext="${post.sanitizedContent.value}">
          정제된 본문
        </div>
      </section>
      <dl>
        <dt>작성일</dt>
        <dd th:text="${post.publishedOn}">2026-07-14</dd>
        <dt>유니코드 코드 포인트 수</dt>
        <dd th:text="|${post.characterCount}자|">45자</dd>
      </dl>
      <a id="permalink"
         th:href="@{/expression/posts/{id}(id=${post.id})}">
        고유 링크
      </a>
    </article>
  </main>
</body>
</html>

package board.expression;

import java.util.Objects;

import org.jsoup.Jsoup;
import org.jsoup.nodes.Document;
import org.jsoup.safety.Safelist;

public final class SanitizedHtml {
    private static final Safelist POLICY = new Safelist()
            .addTags("p", "strong", "em", "code", "ul", "ol", "li", "a")
            .addAttributes("a", "href")
            .addProtocols("a", "href", "https");

    private static final Document.OutputSettings OUTPUT =
            new Document.OutputSettings().prettyPrint(false);

    private final String value;

    private SanitizedHtml(String value) {
        this.value = value;
    }

    public static SanitizedHtml fromUntrusted(String rawHtml) {
        var cleaned = Jsoup.clean(
                Objects.requireNonNull(rawHtml, "rawHtml"),
                "",
                POLICY,
                OUTPUT);
        return new SanitizedHtml(cleaned);
    }

    public String getValue() {
        return value;
    }
}

package board.expression;

import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.model;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.view;

import java.nio.charset.StandardCharsets;
import java.time.LocalDate;

import org.jsoup.Jsoup;
import org.jsoup.nodes.Document;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.boot.test.context.TestConfiguration;
import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
import org.springframework.context.annotation.Bean;
import org.springframework.test.web.servlet.MockMvc;

@SpringBootTest(classes = {
        ExpressionApplication.class,
        PostExpressionRenderingTest.FixtureConfiguration.class
})
@AutoConfigureMockMvc
class PostExpressionRenderingTest {
    private static final String PLAIN =
            "<script>alert('plain')</script> 😀";

    @Autowired
    MockMvc mvc;

    @Test
    void controller가_view_model과_code_point_수를_확정한다()
            throws Exception {
        var result = mvc.perform(get("/expression/posts/7"))
                .andExpect(status().isOk())
                .andExpect(view().name("expression/posts/detail"))
                .andExpect(model().attributeExists("post"))
                .andReturn();

        var page = (PostPage) result.getModelAndView()
                .getModel()
                .get("post");

        assertThat(page.characterCount())
                .isEqualTo(PLAIN.codePointCount(0, PLAIN.length()));
        assertThat(page.publishedOn()).isEqualTo("2026-07-14");
    }

    @Test
    void 일반_문자열은_요소가_아닌_text로_렌더링된다()
            throws Exception {
        var document = render("/expression/posts/7");

        assertThat(document.selectFirst("h1").text())
                .isEqualTo("<img src=x onerror=alert(1)> 기록");
        assertThat(document.selectFirst("#plain-content").text())
                .isEqualTo(PLAIN);
        assertThat(document.select("h1 img, #plain-content script"))
                .isEmpty();
    }

    @Test
    void 정제_HTML만_허용된_markup으로_렌더링된다()
            throws Exception {
        var document = render("/expression/posts/7");
        var preview = document.selectFirst("#safe-markdown");

        assertThat(preview.select("strong").text()).isEqualTo("허용");
        assertThat(preview.select("script, img, [onerror]"))
                .isEmpty();
        assertThat(preview.select("a[href^=javascript]")).isEmpty();
        assertThat(preview.select("a[href='https://example.com/guide']"))
                .hasSize(1);
    }

    @Test
    void URL_표현식은_context_path를_포함한다() throws Exception {
        var result = mvc.perform(get("/academy/expression/posts/7")
                        .contextPath("/academy"))
                .andExpect(status().isOk())
                .andReturn();
        var document = Jsoup.parse(result.getResponse()
                .getContentAsString(StandardCharsets.UTF_8));

        assertThat(document.selectFirst("#permalink").attr("href"))
                .isEqualTo("/academy/expression/posts/7");
    }

    private Document render(String path) throws Exception {
        var result = mvc.perform(get(path))
                .andExpect(status().isOk())
                .andReturn();
        return Jsoup.parse(result.getResponse()
                .getContentAsString(StandardCharsets.UTF_8));
    }

    @TestConfiguration(proxyBeanMethods = false)
    static class FixtureConfiguration {
        @Bean
        PostQuery postQuery() {
            return id -> new PostQuery.PostSnapshot(
                    id,
                    "<img src=x onerror=alert(1)> 기록",
                    PLAIN,
                    "<p><strong>허용</strong>"
                            + "<script>alert('x')</script>"
                            + "<img src=x onerror=alert(1)>"
                            + "<a href=javascript:alert(1)>위험</a>"
                            + "<a href=https://example.com/guide>안전</a></p>",
                    LocalDate.of(2026, 7, 14));
        }
    }
}