#17419: Add a JSON template filter
-----------------------------------+-------------------------------------
Reporter: lau | Owner: aaugustin
Type: New feature | Status: new
Component: Template system | Version: master
Severity: Normal | Resolution:
Keywords: json template tag | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-----------------------------------+-------------------------------------
Comment (by apollo13):
Replying to [comment:25 natevw]:
> The suggested patch has rather surprising behavior to me, with its
custom escaping. Normally an HTML attribute is the *best* place to put
JSON-formatted data
I would not necessarily agree on *best*. `<script
type="application/json">` is just as valid as a data attribute and
requires way less escaping. Strictly speaking, if you are actually putting
a lot of small JSON snippets into data attributes, escaping takes up quite
a bit of space (And we've all learned by now that compressing the output
inside TLS can be dangerous). That aside, your argument is not actually
correct; depending on the HTML attribute you are using, different escaping
rules apply (think of all the js event attributes [onclick etc…]).
So in the end, we at least need documentation on how to safely use JSON in
HTML (though one might argue that docs exist already outside of Django and
this is not Django specific) and/or make usages outside of `data-*`
attributes also safe (ie the json filter for the most "common"
situations).
Regarding:
> Obviously this is very different usage than intended by django-
argonauts, as evidenced by the examples their current README, which are
using the output as JavaScript literals directly within an inline script.
Yes, this is imo an important example as loads and loads of tutorials on
the web suggest such a usage (for better or worse).
--
Ticket URL: <https://code.djangoproject.com/ticket/17419#comment:26>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/061.5aa025abb41840f4be92ea15ab0381dc%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
