assertHTMLEqual() shows a confusing error with escaped HTML.

[Pratyush Mittal]

The diff shown in the error message of assertHTMLEqual seems to be converting escaped HTML text to unescaped text.

This makes it hard to write tests when testing XSS vulnerabilities in our tags and filters. Though the assertions work correct, the error messages don't show the correct differences.

Steps to reproduce

from django.test import TestCase

class UtilsTestCase(TestCase):
def test_assersion(self):
	escaped = "<p>&lt;foo&gt;</p>"
	raw = "<p><foo></p>"
	self.assertHTMLEqual(escaped, raw)

Expected Output

AssertionError: <p>
&lt;foo&gt;
</p> != <p>
<foo>
</p>
  <p>
- &lt;foo&gt;
+ <foo>
  </p>

Actual Output

AssertionError: <p>
<foo>
</p> != <p>
<foo>
</p>
  <p>
  <foo>
  </p>

[Pratyush Mittal]

The bug is probably caused because the __str__ method in the Element class treats all its children the same. The children are either a tree or string. In the case of a string, the Python's HTMLParser unescapes the contents. For their string representation, we probably need to escape them back.

I have tried to fix this in this pull-request: ​https://github.com/django/django/pull/15033

[Mariusz Felisiak <felisiak.mariusz@…>]

In f38458fe:

Fixed #33236 -- Fixed assertHTMLEqual() error messages for escaped HTML.