stringfilter decorator is incompatible with is_safe / needs_autoescape flags

[Aymeric Augustin]

Defining a template filter like this doesn't work:

@register.filter
@stringfilter
def passthrough(value):
    return value
passthrough.is_safe = True

The problem is that the stringfilter decorator keeps a pointer to the underlying function, and the template engine uses it.

However, the last line only sets is_safe on the function returned by the decorator, not on the underlying function. As a consequence, the template engine doesn't know that the filter is safe.

[Aymeric Augustin]

Second version of the patch adds docs.

I moved the paragraph about stringfilter after the parapraph about escaping because I needed to reference the escaping control flags.

[Aymeric Augustin]

As pointed out by Alex, the flags are related to the filter, not the fact that it operates on strings (even if the design flaw is in stringfilter).

The new patch passes the is_safe and needs_autoescape flags as keyword arguments to @register.filter, which makes more sense and is compatible with decorators. It includes docs and deprecation of the current syntax.

[Aymeric Augustin]

In [17056]:

Fixed #17135 -- Made it possible to use decorators (like stringfilter) on template filter functions in combination with auto-escaping. Refs #16726.