Re: htmlfill inadvertently escaping input field values
Philip Jenvey <[email protected]>
| Newsgroups | gmane.comp.python.formencode |
|---|---|
| Message-ID | <[email protected]> |
On May 19, 2007, at 3:28 PM, Ian Bicking wrote:
> Philip Jenvey wrote:
>> This was reported on the Pylons trac: http://pylonshq.com/project/
>> pylonshq/ticket/212
>> The problem is htmlfill htmlescapes all input field values it
>> comes across. E.g.:
>> $ cat formencode_test.py
>> from formencode import htmlfill
>> html = """
>> <html>
>> <body>
>> <form action="/submit" method="POST">
>> <div id="hello">Hello →</div>
>> <input type="submit" value="Submit →" />
>> </form>
>> </body>
>> </html>"""
>> rendered = htmlfill.render(html, {}, {})
>> assert "Hello →" in rendered, rendered
>> assert '"Submit →"' in rendered, rendered
>> $ python formencode_test.py
>> Traceback (most recent call last):
>> File "formencode_test.py", line 15, in ?
>> assert '"Submit →"' in rendered, rendered
>> AssertionError:
>> <html>
>> <body>
>> <form action="/submit" method="POST">
>> <div id="hello">Hello →</div>
>> <input type="submit" value="Submit &rarr;" />
>> </form>
>> </body>
>> It should really only htmlescape field values pulled out of the
>> defaults dictionary (not mess with other HTML).
>
> Well, it seems like it's not unescaping them when it reads them; if
> it did that would also fix it.
>
Unescaping > and the like is easy enough, but there could be non-
ascii html entities. Since the html form passed to htmlfill is
typically a raw string in this case, I think handling those would be
tricky.
Patching htmlfill to avoid escaping values from the html looks like a
little work, but overall probably simpler.
--
Philip Jenvey
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/