Ticket #20368: 20368fix-against-56d6fdbbf50b29bd162fd5ab3296a25127d7af65.diff

django/template/defaultfilters.py

@@ -414 +414 @@
     """
     return escape(value)
 
+@register.filter(is_safe=True)
+@stringfilter
+def nonraising_force_escape(value):
+    """
+    Escapes a string's HTML. This returns a new string containing the escaped
+    characters, or in case of exception in force_escape() 
+    (in particular MemoryError), a unicode string notifying 
+    about the exception. Never raises any exception derived from Exception.
+    """
+    try:
+        return force_escape(value)
+    except Exception, e:
+        return u"cannot render value due to exception in force_escape(): %s" % e.__class__.__name__
+
 @register.filter("linebreaks", is_safe=True, needs_autoescape=True)
 @stringfilter
 def linebreaks_filter(value, autoescape=None):

django/views/debug.py

@@ -11 +11 @@
 from django.http import (HttpResponse, HttpResponseServerError,
     HttpResponseNotFound, HttpRequest, build_request_repr)
 from django.template import Template, Context, TemplateDoesNotExist
-from django.template.defaultfilters import force_escape, pprint
+from django.template.defaultfilters import nonraising_force_escape, pprint
 from django.utils.html import escape
 from django.utils.encoding import force_bytes, smart_text
 from django.utils.module_loading import import_by_path
@@ -246 +246 @@
         frames = self.get_traceback_frames()
         for i, frame in enumerate(frames):
             if 'vars' in frame:
-                frame['vars'] = [(k, force_escape(pprint(v))) for k, v in frame['vars']]
+                frame['vars'] = [(k, nonraising_force_escape(pprint(v))) 
+                    for k, v in frame['vars']]
             frames[i] = frame
 
         unicode_hint = ''
@@ -584 +585 @@
 <body>
 <div id="summary">
   <h1>{% if exception_type %}{{ exception_type }}{% else %}Report{% endif %}{% if request %} at {{ request.path_info|escape }}{% endif %}</h1>
-  <pre class="exception_value">{% if exception_value %}{{ exception_value|force_escape }}{% else %}No exception supplied{% endif %}</pre>
+  <pre class="exception_value">{% if exception_value %}{{ exception_value|nonraising_force_escape }}{% else %}No exception supplied{% endif %}</pre>
   <table class="meta">
 {% if request %}
     <tr>
@@ -609 +610 @@
 {% if exception_type and exception_value %}
     <tr>
       <th>Exception Value:</th>
-      <td><pre>{{ exception_value|force_escape }}</pre></td>
+      <td><pre>{{ exception_value|nonraising_force_escape }}</pre></td>
     </tr>
 {% endif %}
 {% if lastframe %}
@@ -639 +640 @@
 {% if unicode_hint %}
 <div id="unicode-hint">
     <h2>Unicode error hint</h2>
-    <p>The string that could not be encoded/decoded was: <strong>{{ unicode_hint|force_escape }}</strong></p>
+    <p>The string that could not be encoded/decoded was: <strong>{{ unicode_hint|nonraising_force_escape }}</strong></p>
 </div>
 {% endif %}
 {% if template_does_not_exist %}
@@ -717 +718 @@
               <tbody>
                 {% for var in frame.vars|dictsort:"0" %}
                   <tr>
-                    <td>{{ var.0|force_escape }}</td>
+                    <td>{{ var.0|nonraising_force_escape }}</td>
                     <td class="code"><pre>{{ var.1 }}</pre></td>
                   </tr>
                 {% endfor %}
@@ -770 +771 @@
 {% if frame.context_line %}  {{ frame.lineno }}. {{ frame.context_line|escape }}{% endif %}
 {% endfor %}
 Exception Type: {{ exception_type|escape }}{% if request %} at {{ request.path_info|escape }}{% endif %}
-Exception Value: {{ exception_value|force_escape }}
+Exception Value: {{ exception_value|nonraising_force_escape }}
 </textarea>
   <br><br>
   <input type="submit" value="Share this traceback on a public Web site">

tests/view_tests/tests/test_debug.py

@@ -16 +16 @@
     restore_template_loaders)
 from django.utils.encoding import force_text, force_bytes
 from django.views.debug import ExceptionReporter
+from django.template import defaultfilters 
 
 from .. import BrokenException, except_args
 from ..views import (sensitive_view, non_sensitive_view, paranoid_view,
@@ -105 +106 @@
         self.assertIn('<h2>Request information</h2>', html)
         self.assertNotIn('<p>Request data not supplied</p>', html)
 
+    def test_request_and_exception_when_escaping_raises(self):
+        "Complete rendering of exception report if escaping raises exception"
+        # specifically if it raises MemoryError
+        
+        try:
+            request = self.rf.get('/test_view/')
+            raise ValueError("Can't find my keys")
+        except ValueError:
+            exc_type, exc_value, tb = sys.exc_info()
+        
+        def mock_escape_that_raises(*args, **kwargs):
+            raise MemoryError()
+            
+        orig_escape = defaultfilters.escape
+        try:
+            defaultfilters.escape = mock_escape_that_raises
+            reporter = ExceptionReporter(request, exc_type, exc_value, tb)
+            html = reporter.get_traceback_html()
+            self.assertIn('<h1>ValueError at /test_view/</h1>', html)
+            self.assertIn('<pre class="exception_value">cannot render value due to exception in force_escape(): MemoryError</pre>', html)
+        finally:
+            defaultfilters.escape = orig_escape
+
     def test_no_request(self):
         "An exception report can be generated without request"
         try: