'Safe strings' are not force-escaped on development 500 page
|Reported by:||elijahr||Owned by:||elijahr|
|Severity:||Keywords:||debug.py 500 escape|
|Cc:||Triage Stage:||Design decision needed|
|Has patch:||yes||Needs documentation:||no|
|Needs tests:||yes||Patch needs improvement:||no|
In the 'Local vars' section of the debugging 500 error page, strings that have been 'marked safe' are not escaped before output, which has often resulted in HTML from my variables being inserted into the page.
While using 'mark_safe' on a string variable indicates that the string should not be escaped further, I think an exception should be made for the debugging 500 page, based on my assumption that most developers would rather see a string's value than the resultant HTML elements.
I have attached a patch that uses 'force_escape' in lieu of 'escape'.
Change History (5)
Changed 6 years ago by elijahr
comment:1 Changed 6 years ago by elijahr
- Owner changed from nobody to elijahr
- Status changed from new to assigned
comment:2 Changed 6 years ago by VickyTuite
- Needs tests set
- Triage Stage changed from Unreviewed to Accepted
comment:3 Changed 6 years ago by VickyTuite
- Triage Stage changed from Accepted to Design decision needed