Opened 8 years ago

Closed 8 years ago

#27783 closed Bug (fixed)

VariableDoesNotExist can lead to stack overflows unusually easily

Reported by: Ryan O’Hara Owned by: Ryan O’Hara
Component: Template system Version: 1.10
Severity: Normal Keywords:
Cc: Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

If a form is overridden to render a template (django-floppyforms does this):

class ExampleForm(forms.Form):
    def as_table(self):
        return render(None, 'example.html', {'form': self})

and the template refers to a nonexistent attribute on the form:

{{ form.boom }}

printing the VariableDoesNotExist will cause it to attempt to stringify the form for context again.

Tentative patch changes it to always repr(), which seems appropriate and has the advantage of showing dict context like this:

Failed lookup for key [author] in {'section': '"News"'}

instead of like this:

Failed lookup for key [author] in '{\'section\': \'"News"\'}'

Change History (5)

comment:1 by Ryan O’Hara, 8 years ago

Owner: changed from nobody to Ryan O’Hara
Status: newassigned

comment:3 by Claude Paroz, 8 years ago

Triage Stage: UnreviewedAccepted

comment:4 by Thomas Hauk, 8 years ago

Also the cause of an exception death spiral in DRF, c.f.: https://github.com/tomchristie/django-rest-framework/issues/3736

Would love to see this patch integrated into Django!

comment:5 by Tim Graham <timograham@…>, 8 years ago

Resolution: fixed
Status: assignedclosed

In 7c4289d:

Fixed #27783 -- Switched VariableDoesNotExist.str() to repr() context.

Using str() and then repr'ing the result looks strange and can lead
to recursive rendering of forms.

Note: See TracTickets for help on using tickets.
Back to Top