[ZCM] [ZC] 2292/11 Wontfix "entity refs inside zope"

Issue #2292 Update (Wontfix) "entity refs inside zope"
 Status Wontfix, Zope/bug medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/2292

==============================================================
= Wontfix - Entry #11 by ajung on Jun 9, 2007 2:07 am

 Status: Pending => Wontfix


________________________________________
= Comment - Entry #10 by fgsch on Mar 19, 2007 12:01 pm

i've already mentioned this to the people involved. now, this does not mean that zope rewritting &foo= to &foo;= is correct.
________________________________________
= Comment - Entry #9 by chrisw on Mar 19, 2007 11:45 am

If you want &foo to show, why aren't you writing &foo like you should be?
________________________________________
= Comment - Entry #8 by fgsch on Mar 19, 2007 11:20 am

of course, in my last follow i meant, raising an exception. sorry about that.
________________________________________
= Comment - Entry #7 by fgsch on Mar 19, 2007 9:31 am

> A couple of things:
> 
>  - What is your real use case here?  '&foo' is not a valid
>    entity without the semicolon;  do you expect the browsers
>    to treat it like one?  If so, then adding the semicolon
>    is harmless.  If not, then you are asking that we either
>    tolerate unescaped ampersands, which are *evil* in HTML, or
>    else raise an exception.

  I don't think the current behaviour is ok. If I write &foo, at least i don't expect Zope to rewrite it as &foo;.
  What would be the correct behaviour? I guess raising a bug, or validating the input, but not adding the semicolon.
  I don't expect the browsers to treat &foo as a valid entity reference (it is under XML but not under HTML if I understood correctly from my readings), but again, I neither expect Zope to add the semicolon.
 
>  - I could live with the exception, because the "warning" in
>    HTML would / should be an absolute failure in XML mode:
>    in XML, no unescaped ampersands are allowed, period.

  Agreed.

>  - Because you are the person with the "itch", your chance
>    of getting it "scratched" would be greatly improved if you
>    supplied a patch with tests.

  Ok, i will try to prepare something.

  f.-
________________________________________
= Comment - Entry #6 by tseaver on Mar 19, 2007 9:22 am

A couple of things:

 - What is your real use case here?  '&foo' is not a valid
   entity without the semicolon;  do you expect the browsers
   to treat it like one?  If so, then adding the semicolon
   is harmless.  If not, then you are asking that we either
   tolerate unescaped ampersands, which are *evil* in HTML, or
   else raise an exception.

 - I could live with the exception, because the "warning" in
   HTML would / should be an absolute failure in XML mode:
   in XML, no unescaped ampersands are allowed, period.

 - Because you are the person with the "itch", your chance
   of getting it "scratched" would be greatly improved if you
   supplied a patch with tests.
________________________________________
= Comment - Entry #5 by fgsch on Mar 19, 2007 8:33 am

the problem is not support sloppy entitites, the problem is zope is adding a semicolon when it shouldn't. that's all. this should be fixed imho. if you want to barf about the unexistent entity, fine, but shouldn't add a semicolon.
________________________________________
= Comment - Entry #4 by ajung on Mar 19, 2007 8:29 am

There is no need in Zope to support sloppy entities.
+1 to reject this issue.


________________________________________
= Comment - Entry #3 by fgsch on Mar 19, 2007 8:24 am

This is true but all the browsers seem to believe &something is valid (or at least do not try to add a semicolon at the end), so even if this is not the case, following the common behaviour would be better.
________________________________________
= Comment - Entry #2 by tseaver on Mar 19, 2007 8:20 am

ZPT generally requires well-formedness in the templates, although
the output may not be well-formed in cases where the 'structure'
modifier is used.  Your example is not Would you prefer that ZPT just mark that as an error?  

For instance, here is what 'tidy' says about a document including
your example::

 $ cat test.html
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
 <html>
 <title>Test Zope Collector #2292</title>
 <body>
 <h1>Test Zope Collector #2292</h1>
 <div>&messageId</div>
 </body>
 </html>
 $ tidy -e test.html
 line 6 column 6 - Warning: unescaped & or unknown entity "&messageId"
 ...

________________________________________
= Request - Entry #1 by fgsch on Mar 19, 2007 7:44 am

This is really a bug in python, but I've been suggested to fill it here so Zope can workaround it. The text '<div>&messageId</div>' is wrongly rendered as '<div>&messageId;=</div>' in a Page Template as the HTMLParser module in python wrong matches '&something' as an entity reference.
I'll open a separate bug with Python, but it'd be nice if Zope can cope with this issue until is fixed. Thanks.

==============================================================