How to prevent Twirl from HTMLentities-encode strings in script scetion?

Question

I'm trying to embed JsonLd into my pages using Twirl, but for some reason the content gets HTMLentities-encoded.

My (twirl template) html looks like this:

@(jsonLd: String)(implicit config: play.api.Configuration)
@main() {
  <script type="application/ld+json">
    @jsonLd
  </script>
}

But when I look in the web browser I see something like: {"@type":"DataRecord","@context"... etc.

How can I prevent @jsonLd from getting encoded??

Answer 1

By default, all dynamic contents is encoded for security reasons to avoid some common attacks (XSS). See here: https://www.playframework.com/documentation/2.8.x/ScalaTemplates#Escaping

You can use

@Html(jsonLd)