#23937: Templates: control characters should be filtered out
-------------------------+-------------------------------------------------
Reporter: jogc | Owner: nobody
Type: Bug | Status: new
Component: | Version: 1.6
Template system | Keywords: control charcaters c0 codes
Severity: Normal | templates
Triage Stage: | Has patch: 0
Unreviewed | UI/UX: 0
Easy pickings: 0 |
-------------------------+-------------------------------------------------
When rendering the value of variables, Django does automatic HTML escaping
by default, but it does not filter out control characters that are invalid
in HTML. It should.
Invalid C0 control characters are x00-x08, 0xB-x0C, x0E-x1F. At the very
least x00 should be filtered out, since its invalid in every version of
HTML/XHTML/XML.
Reproduce:
Put \x00 in a variable and expand it in a template, save the resulting
html and upload it to W3s validator.
References:
http://en.wikipedia.org/wiki/Character_encodings_in_HTML#Illegal_characters
http://en.wikipedia.org/wiki/Valid_characters_in_XML
http://www.w3.org/TR/xml11/#charsets
http://www.i18nguy.com/test/controls.htm
--
Ticket URL: <https://code.djangoproject.com/ticket/23937>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/047.b0926312815ff5aebee3fdb1646b0864%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
