#12772: Allow loading template tags by fully qualified python module path
---------------------------------+------------------------------------
Reporter: patrys | Owner: patrys
Type: New feature | Status: assigned
Component: Template system | Version: 1.2-beta
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 1
Needs tests: 1 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------
Comment (by carljm):
There's a significant difference between `settings.ALLOWED_INCLUDE_ROOTS`
and arbitrary imports. If we didn't have the former, a template author
could access literally any file on the filesystem, as text. The latter
only allows accessing files that are on `sys.path` within a valid Python
package, and even then only in a limited way - by interpreting them as
Python code. The former is much worse as a security risk.
That said, it has never been entirely clear (to me, anyway) whether
"completely untrusted template author" is a use-case that Django intends
to support out of the box. I doubt the template language currently meets
that bar very well, so I think we'd have some work to do if the answer is
"yes". But I do agree that if the answer to that is "yes", this patch
should probably not go in.
Apart from the security concerns: while I fully agree that the flattened
app-label namespace is silly and problematic, it feels strange to me to
have Python import semantics reflected even more directly into the
template engine. I prefer the Jinja2 approach, where the things that you
can import from templates are other templates containing macros; if you
want Python functions directly in the context, you have to put them there
explicitly in Python code, you don't "import" Python modules from
templates. The current DTL approach is less explicit than the Jinja2
approach, but at least with the current DTL approach the Python developer
still has to explicitly nominate which modules should be available to the
templates.
So I think I hover somewhere around +/-0 on this patch.
--
Ticket URL: <https://code.djangoproject.com/ticket/12772#comment:26>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.d5702b6310e4a672534957e15d1e4a01%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
