debugerror_t does not escape variables, having the side effect of about webpy HOT 6 CLOSED

This should be happening at the template processing level...you shouldn't need to wrap every variable inside the template.

from webpy.

What to you mean when you say "at processing level"? Do you mean filtering? This doesn't happen, at least to me.

from webpy.

Then it sounds like that's the bug... Does filtering not work for you at all or only on error pages?

from webpy.

I reproduced in a minimal environment. While the application I'm writing should run on google appengine i moved djangoerror_t in a template and replaced the following lines:

global djangoerror_r
if djangoerror_r is None:
    djangoerror_r = Template(djangoerror_t, filename=__file__, filter=websafe)

with:

global djangoerror_r
if djangoerror_r is None:
    djangoerror_r = render('templates').debugerror

and actually the error raise only in a modified version. So I tried a minimal example and seems that variables loaded from templates are not escaped. Here the code:

import web
from google.appengine.ext.webapp.util import run_wsgi_app


web.config['debug'] = True
urls = (
    '/', 'index',
    '/error', 'error'
)
app = web.application(urls, globals())
render = web.template.render('templates')


class index:

    def GET(self):
        return render.index('<marco>')


class error:

    def GET(self):
        return render.error()


def main():
    application = app.wsgifunc()
    run_wsgi_app(application)


if __name__ == '__main__':
    main()

and the template:

$def with (who)

hello $who

from webpy.

I found the bug. the problems rise in compiled templates used by appengine. By default variables are escaped by escape_ func which is a CompiledTemplate method but of a dummy object. This template haven't an associated file and as result in template.py:866 the associated filter is None. I hope i was clear.

PS. Which is the preferred/ufficial bug tracker? this one or the lauchpad one?

from webpy.

Fixed escaping issue on GAE. closed by 84205cf.

from webpy.