Escaping of validation errors

[Petr Marhoun <petr.marhoun@…>]

Error classes from django.newforms.utils.py don't escape error messages:

class ErrorList(list, StrAndUnicode):

    def as_ul(self):
        if not self: return u''
        return mark_safe(u'<ul class="errorlist">%s</ul>'
                % ''.join([u'<li>%s</li>' % force_unicode(e) for e in self]))

I don't thing that author of validation error (or translator) should use html escaping - message can be used in another context. But utility method as_ul is for html so I think it should escape it.

I am not sure if my patch is the right solution but it works for me.

[Gary Wilson]

Should probably be using conditional_escape() instead of escape() here so that it won't get double-escaped if the developer already escaped the text.

[Petr Marhoun <petr.marhoun@…>]

It is not so simple as it seemed to be:

• There are more problems in django.newforms.utils.
• There are some interactions between ErrorList and ErrorDict.
• There are some interactions between ErrorList and BaseForm.

The new patch should solve it and its tests should prove it.

[Petr Marhoun <petr.marhoun@…>]

New version of patch does not remove escape in _html_output - it only replaces it with conditional_escape. I think it is safer.

[Petr Marhoun <petr.marhoun@…>]

I thing the last version of patch has sensible tests (the previous one was quite strange for a validation error) and also quite similar solution as [8601] (Allow safe-strings in the "attrs" parameter to form widgets). So I changed "Needs tests" and "Patch needs improvement".

[Thomas Güttler]

I installed validation-escaping.5.diff today and it works the way it should. The unittest "./runtests.py forms" pass. I think it is ready for checkin.

[Karen Tracey]

(In [9365]) Fixed #6160, #9111 -- Consistently apply conditional_escape to form errors and labels when outputing them as HTML.

[Karen Tracey]

(In [9366]) [1.0.X] Fixed #6160, #9111 -- Consistently apply conditional_escape to form errors and labels when outputing them as HTML.

[9365] from trunk.