pongo2 icon indicating copy to clipboard operation
pongo2 copied to clipboard

filter linebreaks(br) and escaping

Open pierrre opened this issue 5 years ago • 1 comments

When you use the linebreaks(br) filter, the input is usually pure text, not HTML. If we replace \n with <br \>, then the output becomes HTML. So it must be flagged as safe in the template. Therefore, we need to do value | linebreaksbr | safe in order to handle the inserted br correctly, which is not very user-friendly. But now, the input is considered as safe, which is not necessarily true, because it could contain special HTML character. So the input must also be escaped manually: value | escape | linebreaksbr | safe: even less user-friendly. Wouldn't it be simpler to call html.EscapeString() at the beginning of the filter, and AsSafeValue() at the end ?

pierrre avatar Nov 29 '19 16:11 pierrre

Yes it's not backward compatible, but I think it makes more sense.

pierrre avatar Nov 29 '19 16:11 pierrre