#29179: calling format_html can falsely interpret a strack trace as a str.format
replacement field
-------------------------------------+-------------------------------------
               Reporter:  Stephan    |          Owner:  nobody
  Michaud                            |
                   Type:             |         Status:  new
  Uncategorized                      |
              Component:             |        Version:  1.10
  Uncategorized                      |
               Severity:  Normal     |       Keywords:  format_html, string
           Triage Stage:             |      Has patch:  0
  Unreviewed                         |
    Needs documentation:  0          |    Needs tests:  0
Patch needs improvement:  0          |  Easy pickings:  0
                  UI/UX:  0          |
-------------------------------------+-------------------------------------
 Hi team,

 We have an internal page where we display stack traces on a web page.
 We've been using the `format_html` before rendering the data to the
 template, which has worked well in the past.
 However, one of the stack traces contained a dictionary definition as
 such:
 {{{#!python

 data = urllib.parse.urlencode({'request': self.get_serialized_data()})

 }}}
 Once that string reached the format_html function, it would cause the
 following Exception:
 {{{#!python
 KeyError: "'request'"
 }}}
 due to the call to `format()` recognizing the dictionary as a replacement
 field.

-- 
Ticket URL: <https://code.djangoproject.com/ticket/29179>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/051.8c97f0bedf8a6713d287fe06a6370bcf%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to