Django

Code

Ticket #6514 (closed: fixed)

Opened 5 months ago

Last modified 5 months ago

urlize does not escape url correctly

Reported by: Daniel Pope <dan@mauveinternet.co.uk> Assigned to: nobody
Milestone: Component: Template system
Version: SVN Keywords:
Cc: Triage Stage: Ready for checkin
Has patch: 1 Needs documentation: 0
Needs tests: 0 Patch needs improvement: 0

Description

urlize leaves unencoded characters in href attributes. In particular, & must be escaped as &amp; for valid XHTML. I believe unescaped '&'s are also invalid in HTML but HTML parsers are forgiving about this.

From the regression tests, http://example.com/x=&y= is converted to <a href="http://example.com/x=&y=" rel="nofollow">http://example.com/x=&amp;y=</a>.

It should be converted to <a href="http://example.com/x=&amp;y=" rel="nofollow">http://example.com/x=&amp;y=</a>.

Attachments

urlize.diff (0.9 kB) - added by dtulig on 01/31/08 02:20:28.
Escapes all ampersands.
6514.diff (6.4 kB) - added by SmileyChris on 01/31/08 15:41:52.
6514.2.diff (6.4 kB) - added by SmileyChris on 01/31/08 15:43:26.
6514.3.diff (6.9 kB) - added by SmileyChris on 01/31/08 15:44:59.

Change History

01/30/08 20:11:11 changed by SmileyChris

  • needs_better_patch changed.
  • stage changed from Unreviewed to Accepted.
  • summary changed from urlize does not escape & characters to urlize does not escape url correctly.
  • needs_tests changed.
  • needs_docs changed.

01/31/08 02:20:28 changed by dtulig

  • attachment urlize.diff added.

Escapes all ampersands.

01/31/08 02:20:59 changed by dtulig

  • has_patch set to 1.

01/31/08 04:12:32 changed by Daniel Pope <dan@mauveinternet.co.uk>

  • needs_better_patch set to 1.

This needs a change to the regression test.

01/31/08 15:41:52 changed by SmileyChris

  • attachment 6514.diff added.

01/31/08 15:43:26 changed by SmileyChris

  • attachment 6514.2.diff added.

01/31/08 15:44:59 changed by SmileyChris

  • attachment 6514.3.diff added.

01/31/08 15:46:55 changed by SmileyChris

  • needs_better_patch deleted.
  • stage changed from Accepted to Ready for checkin.

Phew! It wasn't doing anything like it should have been doing.

02/03/08 02:54:27 changed by mtredinnick

  • status changed from new to closed.
  • resolution set to fixed.

(In [7079]) Fixed #6279, #6514 -- Fixed some HTML escaping problems in the urlize filter. Based on a patch from SmileyChris? with some test additions from Rob Hudson. Thanks, both.

Add/Change #6514 (urlize does not escape url correctly)




Change Properties
Action