Changes between Initial Version and Version 1 of Ticket #37262


Ignore:
Timestamp:
Aug 8, 2026, 5:28:53 PM (29 hours ago)
Author:
Adam Johnson
Comment:

Legend:

Unmodified
Added
Removed
Modified
  • Ticket #37262 – Description

    initial v1  
    1 Since #29490 (Django 4.1), `Media` assets may be given as hashable objects
    2 implementing `__html__()`, rendered verbatim as the complete tag, per the old
    3 [https://docs.djangoproject.com/en/5.1/topics/forms/media/#paths-as-objects "Paths as objects" docs section].
    4 Html-safe strings from `mark_safe()` satisfy that contract, but since
    5 8096b5251090bf7539c59956e398b027c7525529 (#37085) they are treated as static
    6 file paths instead: `Media.__init__()` now normalizes every
    7 `isinstance(path, str)` entry into `Script`/`Stylesheet`, and `SafeString` is
    8 a `str` subclass, so e.g.
    9 `forms.Media(js=[mark_safe('<script defer src="https://example.org/asset.js"></script>')])`
    10 renders as
    11 `<script src="/static/%3Cscript%20defer%20src%3D%22https%3A/..."></script>`
    12 rather than the tag verbatim as in 6.0. The same happens for `css` entries but
    13 non-str `@html_safe` classes still work.
     1Since #29490 (Django 4.1), `Media` assets may be given as hashable objects implementing `__html__()`, rendered verbatim as the complete tag, per the old [https://docs.djangoproject.com/en/5.1/topics/forms/media/#paths-as-objects "Paths as objects" docs section].
     2Html-safe strings from `mark_safe()` satisfy that contract, but since 8096b5251090bf7539c59956e398b027c7525529 (#37085) they are treated as static file paths instead: `Media.__init__()` now normalizes every `isinstance(path, str)` entry into `Script`/`Stylesheet`, and `SafeString` is a `str` subclass, so e.g. `forms.Media(js=[mark_safe('<script defer src="https://example.org/asset.js"></script>')])`
     3renders as`<script src="/static/%3Cscript%20defer%20src%3D%22https%3A/..."></script>` rather than the tag verbatim as in 6.0. The same happens for `css` entries but non-str `@html_safe` classes still work.
    144
    155The fix is to skip normalization for any string that provides `__html__()`, so that they take the pre-existing verbatim rendering branch.
Back to Top