Re: XSS and string interpolation

2012-06-28 Thread Alex Ogier
On Thu, Jun 28, 2012 at 1:14 PM, Luke Plant wrote: > > Some other alternatives: build_html, build_html_safe, format_html > +1 for format_html. Best, Alex Ogier -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send e

Re: XSS and string interpolation

2012-06-28 Thread Luke Plant
On 28/06/12 16:32, Alex Ogier wrote: > That's an HTML-safe replacement of the str.format() method, so far as > I can tell (except that all parameters must be [safe-]strings). That > allows more idiomatic python, and won't require awkward shims in > python 3, but it would mean that you can't direct

Re: XSS and string interpolation

2012-06-28 Thread Alex Ogier
On Thu, Jun 28, 2012 at 11:18 AM, Alex Ogier wrote: > > Also, to be compatible with python 3 and more idiomatic python, I > would implement the function as: > >    def html_mark_safe(format_string, *args): >        return mark_safe(format_string.format(*map(conditional_escape, args))) > Actually,

Re: XSS and string interpolation

2012-06-28 Thread Alex Ogier
On Thu, Jun 28, 2012 at 10:52 AM, Jeremy Dunck wrote: > > On Jun 28, 2012, at 6:57 AM, Luke Plant wrote: > > > Hi all, > > > > 2) Any better name than 'html_fragment'? > > > > I like the general approach, but I miss the security-minded namse of > "escape" and "mark safe".   Maybe "safe_html_fragm

Re: XSS and string interpolation

2012-06-28 Thread Jeremy Dunck
On Jun 28, 2012, at 6:57 AM, Luke Plant wrote: > Hi all, > > 2) Any better name than 'html_fragment'? > I like the general approach, but I miss the security-minded namse of "escape" and "mark safe". Maybe "safe_html_fragment" or "make_safe_html_fragment"? Getting annoyingly long, I know.

XSS and string interpolation

2012-06-28 Thread Luke Plant
Hi all, Django's code base has quite a few instances of string interpolation being used to build up HTML e.g.: contrib/admin/util.py return mark_safe('%s: %s' % (escape(capfirst(opts.verbose_name)), admin_url,