Re: Should jinja2 run with autoescape set to true?

On Tue, Jan 14, 2020 at 09:01:23PM -0500, John Rouillard wrote:
> Hi Christof:
> 
> On Mon, Jan 13, 2020 at 4:30 PM Christof Meerwald <[email protected]> wrote:
> > On Mon, Jan 13, 2020 at 01:38:38PM +0100, Ralf Schlatterbeck wrote:
> > > I'm not familiar how jinja handles i18n,
> > So the current jinja2 template doesn't use the jinja2 i18n extension
> >
> > Moving the translation stuff to use the jinja2 i18n extension and then
> > enabling autoescape would look like this:
> > https://bitbucket.org/cmeerw/roundup/commits/915f4f12fa8fbbab33f06291e9c5d7ac39d2d277?at=jinja2-autoescape
> >
> > Do we want to apply that change?
> 
> I like this. I see you have removed |e and added |safe in the jinja
> templates. I assume the  |e did the escaping which is not needed with
> autoescape enabled,
> then |safe disables escaping where you need it. This is nice in that
> it defaults to making bad stuff harder to do.

Yes... I have pushed that now with some doc updates.


> Questions:
> 1)  does this change mean that we need a new way to extract
> translatable strings from the templates (c.f.
> roundup/cgi/TAL/talgettext.py)? (Were we supplying any way to do it
> with the old python based i18n mechanism?)

We haven't provided anything so far, but ideally we should then use
"jinja2.Environment.extract_translations" to get that information.

> 2) is the i18n extension a vendor supplied mechanism that comes with a
> jinja install or is it another pip call?

That extension is actually part of the normal jinja package.

> 3) is the performance of the i18n extension as good as the original python code?

I don't really know, but would expect it to be similar to the previous
code.


Christof

-- 

http://cmeerw.org                              sip:cmeerw at cmeerw.org
mailto:cmeerw at cmeerw.org                   xmpp:cmeerw at cmeerw.org