#33631: Blocktranslate asvar escapes variables, but stores the result as str
instance, leading to double escaping
-------------------------------------+-------------------------------------
Reporter: Richard Ebeling | Owner: nobody
Type: Bug | Status: closed
Component: Uncategorized | Version: 4.0
Severity: Normal | Resolution: wontfix
Keywords: blocktranslate | Triage Stage:
asvar escape | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Carlton Gibson):
* status: new => closed
* resolution: => wontfix
Comment:
Hi Richard, thanks for the report.
So this would be the way forward:
> ... assign a SafeString instance to prevent future escaping
But it's not at all clear how feasible it would be to correctly mark the
returned string as safe. Individual variables are run via
`render_value_in_context()` which escapes them assuming `autoescape` is
enabled, but then the final output is constructed after that, so it's not
clear we can reliably mark it safe.
**Rather** if, in your example, you know `the_title` is safe, declare it
as so: `{{ the_title|safe }}`. The following test case passes:
{{{
diff --git a/tests/template_tests/syntax_tests/i18n/test_blocktranslate.py
b/tests/template_tests/syntax_tests/i18n/test_blocktranslate.py
index 4a162362c6..967a7c1829 100644
--- a/tests/template_tests/syntax_tests/i18n/test_blocktranslate.py
+++ b/tests/template_tests/syntax_tests/i18n/test_blocktranslate.py
@@ -388,6 +388,23 @@ class I18nBlockTransTagTests(SimpleTestCase):
output = self.engine.render_to_string("i18n39")
self.assertEqual(output, ">Seite nicht gefunden<")
+ @setup(
+ {
+ "issue33631": (
+ """
+ {% load i18n %}
+ {% blocktranslate asvar the_title %}The title is
{{title}}.{% endblocktranslate %}
+ < title > {{the_title|safe}} < / title >
+ < meta name="description" content="{{ the_title|safe }}"
>
+ """
+ )
+ }
+ )
+ def test_issue33631(self):
+ with translation.override("en"):
+ output = self.engine.render_to_string("issue33631", {"title":
"<>& Title"})
+ self.assertNotIn("&lt;", output)
+
@setup(
{
}}}
... and it avoids trying to resolve the difficulty above.
As such, I'm going to say `wontfix` here initially, and ask that you
follow-up on the [https://forum.djangoproject.com/c/internals/i18n/14
Internationalization Topics section of the Django Forum] to get a wider
audience if you'd like to discuss it further.
Thanks.
--
Ticket URL: <https://code.djangoproject.com/ticket/33631#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/0107018022477708-13d5aacc-a9d1-4f1a-a622-4acbc364ce32-000000%40eu-central-1.amazonses.com.
