#24836: force_text doesn't force SimpleLazyObject into a string
---------------------------------+------------------------------------
Reporter: riklaunim | Owner: nobody
Type: Bug | Status: new
Component: CSRF | Version: 1.8
Severity: Release blocker | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------
Comment (by carljm):
I think the bug is in the interaction between the fact that
`SimpleLazyObject` overrides `isinstance` checks in order to pretend to be
its wrapped type, and the performance shortcut at the top of `force_text`:
{{{
if isinstance(s, six.text_type):
return s
}}}
So in the specific situation of a `SimpleLazyObject` wrapping an object of
`six.text_type`, `force_text` does nothing at all, it doesn't cast to
`six.test_type`. (If it actually did cast, we wouldn't have this problem;
`SimpleLazyObject` does not survive a type cast).
IMO the right fix would be to make the shortcut check stricter:
{{{
if issubclass(type(s), six.text_type):
return s
}}}
Then `force_text` would actually behave as its docstring claims, and
resolve all lazy instances (including `SimpleLazyObject`) to strings.
We could make the check even stricter and require an exact class match --
`if type(s) is six.text_type` -- but then `force_text` would begin
reducing string subclasses to the base string class too. I don't have a
clear intuition that it ought to do that, so I think I'd favor the
`issubclass` version.
--
Ticket URL: <https://code.djangoproject.com/ticket/24836#comment:7>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.e2dc353f69e2cab8297bc87815e13393%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
