#34609 closed Cleanup/optimization (fixed)
Deprecate format_html calls without args or kwargs
Reported by: | Adam Johnson | Owned by: | Bhuvnesh |
---|---|---|---|
Component: | Utilities | Version: | dev |
Severity: | Normal | Keywords: | |
Cc: | Triage Stage: | Ready for checkin | |
Has patch: | yes | Needs documentation: | no |
Needs tests: | no | Patch needs improvement: | no |
Easy pickings: | no | UI/UX: | no |
Description (last modified by )
In my experience, a common misuse of format_html
is to format the HTML before calling it:
format_html(f"<i>{name}</i>")
This makes it act like mark_safe
, allowing data through without escaping. It provides a false sense of security since format_html
is meant to be the "safe way".
I propose we deprecate calls to format_html that donβt pass args
or kwargs
, and eventually raise a TypeError
for such cases.
(Following improvement to format_html
docs in #34595.)
Change History (14)
comment:1 by , 2 years ago
Description: | modified (diff) |
---|
comment:2 by , 2 years ago
Triage Stage: | Unreviewed β Accepted |
---|
comment:3 by , 2 years ago
comment:4 by , 2 years ago
Owner: | changed from | to
---|---|
Status: | new β assigned |
comment:5 by , 2 years ago
Description: | modified (diff) |
---|
comment:6 by , 2 years ago
@Bhuvnesh The issues talks about deprecating that args resp. kwargs can be missing.
By raising an exception your suggested change make it impossible to call the function without these parameters. Maybe this is a bit too harsh.
See also βhttps://docs.djangoproject.com/en/dev/internals/release-process/#internal-release-deprecation-policy for documentation how to deprecate a feature.
comment:7 by , 2 years ago
OK, so instead of TypeError
I should raise a RemovedInDjango60Warning warning?
comment:9 by , 2 years ago
Needs documentation: | set |
---|
comment:10 by , 2 years ago
Needs documentation: | unset |
---|---|
Triage Stage: | Accepted β Ready for checkin |
django/utils/html.py
tests/utils_tests/test_html.py
Are these changes relevant? I don't have much experience with templates, still a lot to learn .π