#29602: Django 2.0 breaks interop with Jinja2 forceescape filter
-------------------------------------------+------------------------
Reporter: Richard Eames | Owner: nobody
Type: Bug | Status: new
Component: Template system | Version: 2.0
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------------+------------------------
Not sure if this is a Django bug, jinja bug, or something I need to change
for upgrading to Django 2.0, but since it was a Django commit causes it,
I'm reporting here first.
I recently upgraded to Django 2.0, and shortly after had a complaint from
one of our users about a page not displaying correctly. I tracked down the
issue to a usage of Jinja's `forceescape` filter.
My usage is that we're displaying a preview of an email that will be sent
out, and we do this by using the `srcdoc` attribute of iframe, so our code
looks like:
{{{
<iframe srcdoc="{{ rendered_email | forceescape }}"></iframe>
}}}
The `rendered_email` variable is from a call to
`get_template(template_name).render(ctx)`, which returns a `SafeString`
object. Which makes sense since a rendered template should be html. And
since I want to display the email inside of html again, it needs to be
re-escape, logically with the `forceescape` filter.
However, a change from [https://code.djangoproject.com/ticket/27795 this
ticket]/[https://github.com/django/django/commit/ccfd1295f986cdf628d774937d0b38a14584721f
#diff-58d9f7a5099962dc591a93a47a671b72 this commit] causes the
`forceescape` filter to fail on the jinja side. `forcescape` calls `str()`
on it's argument to remove the "safety", then re-escapes it, however, the
aforementioned commit allow `SafeString` to bypass the assumption that
jinja makes when calling `str()`.
--
Ticket URL: <https://code.djangoproject.com/ticket/29602>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/051.b27e9964fb9052f286890a1633a0e2ca%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
