Opened 3 weeks ago

Closed 3 weeks ago

#37450 closed Bug (fixed)

Template lexer fails on comment/verbatim tags without whitespace after {%

Reported by: Spoko Dev Owned by: Spoko Dev
Component: Template system Version: dev
Severity: Release blocker Keywords:
Cc: Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

Since 1a9fba7a6c2a0acead19bbb45c25ceb0fdcca7c8 (#23424), _comment_end_re and _verbatim_end_re in django/template/base.py require whitespace after {%, so {%endcomment%} and {%endverbatim%} never close a raw block. _raw_start_re requires it too, so with debug=False a {%verbatim%} block is not lexed as raw text. Django 6.1.2 accepts these tags without the spaces.

On main (3d3d943b74):

from django.template import Context, Engine

Engine(debug=True).from_string("{%comment%}hidden{%endcomment%}visible").render(Context())
# TemplateSyntaxError: Unclosed tag on line 1: 'comment'. Looking for one of: endcomment.

Engine().from_string("{% comment %}hidden{%endcomment%}visible").render(Context())
# TemplateSyntaxError: Unclosed tag on line 1: 'comment'. Looking for one of: endcomment.

Engine().from_string("{%verbatim%}{{ x }}{%endverbatim%}").render(Context({"x": 1}))
# AttributeError: 'NoneType' object has no attribute 'engine'

On 6.1.2 these render visible, visible and {{ x }}. With debug=False, {%comment%}…{%endcomment%} alone still renders, but it fails as soon as the template also contains {% comment anywhere, even inside a {# #} comment.

Templates in the wild use this form, for example templates/releasetext.html in postgres/pgweb ({%comment%}…{%endcomment%}): on main, DebugLexer finds no endcomment token in it, while 6.1.2 finds one.

makemessages is affected as well: with {% comment %}note{%endcomment%} before {% translate "Welcome" %}, templatize() no longer outputs "Welcome", so the string is left out of the .po file without an error.

Allowing zero whitespace in the three patterns restores the 6.1.2 behaviour; I have a patch with tests and will open a PR. Open ​PR #21982 changes _comment_end_re and _verbatim_end_re to \s+endcomment\s+ / \s+endverbatim\s+, which keeps this problem and would also require a space before %}.

Change History (7)

comment:1 by Spoko Dev, 3 weeks ago

Has patch: set

comment:2 by Spoko Dev, 3 weeks ago

Owner: set to Spoko Dev
Status: new → assigned

comment:3 by Sarah Boyce, 3 weeks ago

Triage Stage: Unreviewed → Accepted

We discussed this in the PR and thought that the convention of a space should be enforced.
However, that probably shouldn't be included in this change and the value add is limited
Accepting to avoid the breaking change

comment:4 by Sarah Boyce, 3 weeks ago

Needs tests: set

comment:5 by Spoko Dev, 3 weeks ago

Needs tests: unset

comment:6 by Sarah Boyce, 3 weeks ago

Triage Stage: Accepted → Ready for checkin

comment:7 by Sarah Boyce <42296566+sarahboyce@…>, 3 weeks ago

Resolution: → fixed
Status: assigned → closed

In 45fe463:

Fixed #37450 -- Fixed parsing of comment and verbatim tags without spaces.

Regression in 1a9fba7a6c2a0acead19bbb45c25ceb0fdcca7c8.

Note: See TracTickets for help on using tickets.
Back to Top