Engine.render_to_string() should honor the autoescape attribute

[Claude Paroz]

In Engine.render_to_string, a Context is created without specifying the engine autoescape attribute. So if you create en engine with autoescape=False and then call its render_to_string() method, the result will always be autoescaped. It was probably overlooked in [19a5f6da329d58653bcda85].

[Claude Paroz]

I'd like to reserve this for an event I'll attend on Oct 4th.

[Nathan Gaberel]

I'd like to give this a try. Is it OK to reassign to myself since there's been no update in 6 months?

[Simon Charette]

I think it's safe to re-assign yourself the ticket to you at this point. Are you still planing on working on this in the near future Claude?

[Nathan Gaberel]

I went ahead and wrote a patch for it, hopefully Claude won't mind. :)
​PR

[Tim Graham <timograham@…>]

In 62457372:

Fixed #29791 -- Made Engine.render_to_string() honor autoescape.

[Malik A. Rumi]

autoescape off and safe filter both ignored, html entities applied

[Malik A. Rumi]

get_absolute_url shown as removed in chrome dev tools. full name with domain does show.

[Malik A. Rumi]

link destination in bottom left of screen shows html entities escaping my code

[Malik A. Rumi]

I came here because I cannot get autoescape to turn off. First I put it in my template, surrounding the links I wanted to work, but it did not. I looked around and saw that I could control it the same way template inheritance works, so I went to my base html template and put the autoescape tags there. It still had no effect. Then I rebooted, hoping that would make a difference. It did not.

I do not understand how this patch works. Given that at line 20 of engine.py, the init has

autoescape = True,

what are

self.autoescape=autoescape [line 44]

and

autoescape=self.autoescape [line 163]

actually doing? It just looks like a circular assignment to me.

Further, I don’t see how this is connected to template tags. I see no reference to tags in any of this code. Perhaps it is somewhere else, and happens magically, but regardless, I don’t see it.

Finally, I do not understand the test you ran.

self.assertEqual(
            engine.render_to_string('test_context.html', {'obj': '<script>'}),
            'obj:<script>\n',
        )

It looks to me like all you are doing here is removing the curly braces from a dict, and adding a newline. What has that got to do with autoescaping html? The angle brackets in your test object are still there.

In my templates, all that html is removed in favor of html entities - as you can see from the screen shots I attached.. That means the links don't work, don’t display, and give me repeated NoReverseMatch errors even when the code Django tried was correct.

I would ask that you re-open this ticket and make the autoescape tag work as advertised.