Skip to content

Fix #1662: Avoid assigning arbitrary attributes to SafeString instances #1663

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Aug 17, 2022
Merged

Fix #1662: Avoid assigning arbitrary attributes to SafeString instances #1663

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b539415
Add pygments to the dependencies; the template_source view uses it
matthiask Aug 17, 2022
ad55996
Fix #1662: Avoid assigning arbitrary attributes to SafeString instances
matthiask Aug 17, 2022
8b3480a
Remove a left-over pass statement
matthiask Aug 17, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions debug_toolbar/panels/templates/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
from django.template import Origin, TemplateDoesNotExist
from django.template.engine import Engine
from django.template.loader import render_to_string
from django.utils.safestring import mark_safe
from django.utils.html import format_html, mark_safe

from debug_toolbar.decorators import require_show_toolbar

Expand Down Expand Up @@ -50,12 +50,11 @@ def template_source(request):
from pygments import highlight
from pygments.formatters import HtmlFormatter
from pygments.lexers import HtmlDjangoLexer

except ModuleNotFoundError:
source = format_html("<code>{}</code>", source)
else:
source = highlight(source, HtmlDjangoLexer(), HtmlFormatter())
source = mark_safe(source)
source.pygmentized = True
except ImportError:
pass

content = render_to_string(
"debug_toolbar/panels/template_source.html",
Expand Down
6 changes: 1 addition & 5 deletions debug_toolbar/templates/debug_toolbar/panels/template_source.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,6 @@ <h3>{% trans "Template source:" %} <code>{{ template_name }}</code></h3>
</div>
<div class="djDebugPanelContent">
<div class="djdt-scroll">
{% if not source.pygmentized %}
<code>{{ source }}</code>
{% else %}
{{ source }}
{% endif %}
{{ source }}
</div>
</div>
1 change: 1 addition & 0 deletions tox.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ deps =
coverage
Jinja2
html5lib
pygments
selenium
sqlparse
passenv=
Expand Down