Django

Code

Ticket #1204 (closed: fixed)

Opened 3 years ago

Last modified 2 years ago

markup filters shouldn't fail silently

Reported by: nirvdrum Assigned to: adrian
Milestone: Component: Tools
Version: Keywords:
Cc: Triage Stage: Unreviewed
Has patch: 0 Needs documentation: 0
Needs tests: 0 Patch needs improvement: 0

Description

In the source code for the markup app, the comments say that if the appropriate libraries are not installed, the filter will fail silently and return the un-marked-up text. This seems to me to be a bad design decision. If the proper libraries are not installed, the developer should be notified right away. Not marking up the text is not what the developer intended and does not seem to be a case of degrading gracefully.

Additionally, I was unable to find this limitation noted anywhere on the Web site. It wasn't until I dug into the source and read that comment that I discovered why my app wasn't working properly.

Attachments

Change History

01/11/06 23:28:10 changed by ubernostrum

FWIW, the documentation on writing template filters indicates this:

"Filter functions should always return something. They shouldn't raise exceptions. They should fail silently. In case of error, they should return either the original input or an empty string -- whichever makes more sense."

01/12/06 01:00:44 changed by ubernostrum

And hopefully some more clarification on the reasoning for this will be found here.

01/12/06 04:46:01 changed by Simon Willison

There is a potential security problem here. If the filter that fails is one that removes dangerous HTML and that dangerous HTML is spat straight back out again you might end up with an XSS hole. We should at least have filters fail noisily if DEBUG is on. Maybe we should always eat the text rather than spit it out again in production. Errors of this kind in production should be logged as well.

04/23/06 16:27:33 changed by adrian

  • status changed from new to closed.
  • resolution set to fixed.

(In [2730]) magic-removal: Fixed #1204 -- Markup filters now raise a TemplateSyntaxError? if the Python libraries aren't installed and DEBUG=True

Add/Change #1204 (markup filters shouldn't fail silently)




Change Properties
Action