Changeset 6680

Timestamp:

11/17/07 06:11:26 (10 months ago)

Author:

mtredinnick

Message:

Fixed #5945 -- Treat string literals in template filter arguments as safe
strings for auto-escaping purposes.

Files:

• django/trunk/django/template/__init__.py (modified) (2 diffs)
• django/trunk/docs/templates.txt (modified) (1 diff)
• django/trunk/tests/regressiontests/templates/filters.py (modified) (1 diff)
• django/trunk/tests/regressiontests/templates/tests.py (modified) (3 diffs)

django/trunk/django/template/__init__.py

@@ -595 +595 @@
-            for lookup, arg in args:
-                if not lookup:
-arg
+mark_safe(arg)
-                else:
-                    arg_vals.append(arg.resolve(context))
@@ -708 +708 @@
-            # we're also dealing with a literal.
-            if var[0] in "\"'" and var[0] == var[-1]:
-var[1:-1]
+mark_safe(var[1:-1])
-            else:
-                # Otherwise we'll set self.lookups so that resolve() knows we're

django/trunk/docs/templates.txt

@@ -401 +401 @@
-variables that use the ``escape`` filter do not have further automatic
-escaping applied to them.
+
+String literals and automatic escaping
+--------------------------------------
+
+Sometimes you will pass a string literal as an argument to a filter. For
+example::
+
+    {{ data|default:"This is a string literal." }}
+
+All string literals are inserted **without** any automatic escaping into the
+template, if they are used (it's as if they were all passed through the
+``safe`` filter). The reasoning behind this is that the template author is in
+control of what goes into the string literal, so they can make sure the text
+is correctly escaped when the template is written.
+
+This means you would write ::
+
+    {{ data|default:"3 > 2" }}
+
+...rather than ::
+
+    {{ data|default:"3 > 2" }}  <-- Bad! Don't do this.
+
+This doesn't affect what happens to data coming from the variable itself.
+The variable's contents are still automatically escaped, if necessary, since
+they're beyond the control of the template author.
-
-Using the built-in reference

django/trunk/tests/regressiontests/templates/filters.py

@@ -178 +178 @@
-        'filter-unordered_list05': ('{% autoescape off %}{{ a|unordered_list }}{% endautoescape %}', {"a": ["x>", [["<y", []]]]}, "\t<li>x>\n\t<ul>\n\t\t<li><y</li>\n\t</ul>\n\t</li>"),
-
-
-
-
+
+
-        #
-        # Note: we have to use {"a": ""} here, otherwise the invalid template
-        # variable string interferes with the test result.
-&lt;
+<
-        'filter-default02': ('{% autoescape off %}{{ a|default:"x<" }}{% endautoescape %}', {"a": ""}, "x<"),
-        'filter-default03': ('{{ a|default:"x<" }}', {"a": mark_safe("x>")}, "x>"),
-        'filter-default04': ('{% autoescape off %}{{ a|default:"x<" }}{% endautoescape %}', {"a": mark_safe("x>")}, "x>"),
-
-&lt;
+<
-        'filter-default_if_none02': ('{% autoescape off %}{{ a|default:"x<" }}{% endautoescape %}', {"a": None}, "x<"),
-

django/trunk/tests/regressiontests/templates/tests.py

@@ -319 +319 @@
-            'filter-syntax09': ('{{ var|removetags:"b i"|upper|lower }}', {"var": "<b><i>Yes</i></b>"}, "yes"),
-
-Escaped string as argument
+Literal string as argument is always "safe" from auto-escaping..
-            'filter-syntax10': (r'{{ var|default_if_none:" endquote\" hah" }}',
-&quot;
+"
-
-            # Variable as argument
@@ -736 +736 @@
-
-            # translation of constant strings
-ge not found") }}', {'LANGUAGE_CODE': 'de'}, 'Seite nicht gefunden
+ssword") }}', {'LANGUAGE_CODE': 'de'}, 'Passwort
-            'i18n14': ('{% cycle "foo" _("Password") _(\'Password\') as c %} {% cycle c %} {% cycle c %}', {'LANGUAGE_CODE': 'de'}, 'foo Passwort Passwort'),
-            'i18n15': ('{{ absent|default:_("Password") }}', {'LANGUAGE_CODE': 'de', 'absent': ""}, 'Passwort'),
+            'i18n16': ('{{ _("<") }}', {'LANGUAGE_CODE': 'de'}, '<'),
-
-            ### HANDLING OF TEMPLATE_STRING_IF_INVALID ###################################
@@ -886 +887 @@
-            'autoescape-tag07': ("{% autoescape on %}{{ first }}{% endautoescape %}", {"first": mark_safe(u"<b>Apple</b>")}, u"<b>Apple</b>"),
-
-String arguments to filters, if used in the result, are escaped,
-too
-&quot;
+Literal string arguments to filters, if used in the result, are
+safe
+"
-
-            # The "safe" and "escape" filters cannot work due to internal