Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mark output of Template(..., autoescape=True).render() as safe #2003

Open
haxtibal opened this issue Jul 20, 2024 · 0 comments
Open

Mark output of Template(..., autoescape=True).render() as safe #2003

haxtibal opened this issue Jul 20, 2024 · 0 comments

Comments

@haxtibal
Copy link

Consider this minimal example:

from jinja2 import Template

inner = Template('<b>{{ first_name }}</b> {{ last_name }}', autoescape=True).render(first_name='John', last_name="Doe")
outer = Template('Hello,<br/>{{ name }}!', autoescape=True).render(name=inner)
print(outer)

It results in "Hello,<br/>&lt;b&gt;John&lt;/b&gt; Doe!". We have to explicitly mark inner as safe with markupsafe.Markup(inner) or | safe to produce the wanted output "Hello,<br/><b>John</b> Doe!".

The Template knows inner is created with autoescape=True. Couldn't it mark the result of render automatically as safe?

FWIW, the documentation has a related sentence

Jinja functions (macros, super, self.BLOCKNAME) always return template data that is marked as safe.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant