slice filter crashes on an empty dict with Python 3.12

[Tim Richardson]

I have a template with a fragment like this:

<span class="fs-6">Supplier: {{ po_metadata|get_item:dict_item.PONumber|get_item:"supplier" }} PO Date: {{ po_metadata|get_item:dict_item.PONumber|get_item:"order_date" | slice:":10" }} </span>

When using python 3.13.2, I get an exception in django/template/defaultfilters.py slice_filter()

This code does not throw an exception with 3.11

The exception is a Key Error and it happens because instead a list being passed to the filter, a dictionary is. An empty dict in my case.

In python 3.11, the breakpoints in slice_filter() are not hit. Somehow the preceeding filters are behaving differently in case of po_metadata being an empty dict.

[Tim Graham]

Hi Tim, You haven't provided complete steps to reproduce the issue as your snippet involves custom template filters. The issue may be in those filters. You should debug the problem and confirm that Django is at fault. If so, reopen the issue with an explanation. See TicketClosingReasons/UseSupportChannels if you need help.

[Tim Richardson]

Fair enough.

The code below is the slice_filter from the 4.2.11 source.

If you run this code in python 3.11,
the filter returns
{}

(an empty dict)

If you run it in python 3.12, it raises an exception.

Traceback (most recent call last):
  File "/app/./test_filter.py", line 21, in <module>
    r = slice_filter({},":5")
        ^^^^^^^^^^^^^^^^^^^^^
  File "/app/./test_filter.py", line 13, in slice_filter
    return value[slice(*bits)]
           ~~~~~^^^^^^^^^^^^^^

KeyError: slice(None, 5, None)

def slice_filter(value, arg):
    """
    Return a slice of the list using the same syntax as Python's list slicing.
    """
    try:
        bits = []
        for x in str(arg).split(":"):
            if not x:
                bits.append(None)
            else:
                bits.append(int(x))
        return value[slice(*bits)]
    except (ValueError, TypeError) as e:
        return value  # Fail silently.




if __name__ == "__main__":
    r = slice_filter({},":5")
    print(f"{r=}")

I will try to work out why, but this at least describes the problem I think.

[Tim Richardson]

the slice() function is being interpreted as key in 3.12 but not in prior python versions.

the calculation of

bits

is identical.

Python 3.12 docs say that slice objects are now hashable, so it gets treated as a key I suppose.
I wonder how it worked in prior python versions.

Including KeyError in the caught exceptions restores consistent behaviour.

def slice_filter(value, arg):
    """
    Return a slice of the list using the same syntax as Python's list slicing.
    """
    try:
        bits = []
        for x in str(arg).split(":"):
            if not x:
                bits.append(None)
            else:
                bits.append(int(x))
        return value[slice(*bits)]
    except (ValueError, TypeError, KeyError):
        return value  # Fail silently.

[Tim Graham]

Thanks. It looks like unexpected usage since slicing dictionaries doesn't make sense. It won't hurt to fix it, but I don't think the fix will be backported so you may have to work around it in your code.

A test which passes on Python 3.11 and crashes on 3.12.

tests/template_tests/filter_tests/test_slice.py

@@ -53 +53 @@
     def test_fail_silently(self):
         obj = object()
         self.assertEqual(slice_filter(obj, "0::2"), obj)
+
+    def test_empty_dict(self):
+        self.assertEqual(slice_filter({}, "1"), {})

[Tim Richardson]

When I submit a patch for this, is there a preferred way I can request that it be backported to 4.2 LTS, so at least someone considers it?

[Tim Richardson]

PR link

​https://github.com/django/django/pull/18096

[Sarah Boyce]

Hello, thank you for the PR!

When I submit a patch for this, is there a preferred way I can request that it be backported to 4.2 LTS, so at least someone considers it?

Requesting on the ticket is fine. I have considered it, however I agree with Tim Graham that this doesn't qualify for a backport. 4.2 is only receiving security and data loss fixes.
slice is also documented to be for lists (​https://docs.djangoproject.com/en/5.0/ref/templates/builtins/#slice), so I agree this is unexpected usage. I think you will need to make a custom template filter in your code for 4.2.

[Tim Richardson]

thanks. That was my first PR and it was a very well documented, clear and easy process.

[Sarah Boyce <42296566+sarahboyce@…>]

In e64d42e:

Fixed #35395 -- slice filter crashes on an empty dict with Python 3.12.

Keep consistent behaviour of slice() filter between python 3.12 and prior
versions in the case of a dict passed to the filter (catch the new to python
3.12 KeyError exception).