You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2020/06/09 16:26:40 UTC
[GitHub] [airflow] mik-laj commented on a change in pull request #9180: Don't use the `|safe` filter in code, it's risky
mik-laj commented on a change in pull request #9180:
URL: https://github.com/apache/airflow/pull/9180#discussion_r436887040
##########
File path: airflow/www/views.py
##########
@@ -631,11 +630,9 @@ def rendered(self):
for template_field in task.template_fields:
content = getattr(task, template_field)
if template_field in wwwutils.get_attr_renderer():
- html_dict[template_field] = \
- wwwutils.get_attr_renderer()[template_field](content)
+ html_dict[template_field] = wwwutils.get_attr_renderer()[template_field](content)
else:
- html_dict[template_field] = (
- "<pre><code>" + str(content) + "</pre></code>")
+ html_dict[template_field] = Markup("<pre><code>{}</pre></code>").format(str(content))
Review comment:
Don't we need to add an escape here?
##########
File path: airflow/www/views.py
##########
@@ -631,11 +630,9 @@ def rendered(self):
for template_field in task.template_fields:
content = getattr(task, template_field)
if template_field in wwwutils.get_attr_renderer():
- html_dict[template_field] = \
- wwwutils.get_attr_renderer()[template_field](content)
+ html_dict[template_field] = wwwutils.get_attr_renderer()[template_field](content)
else:
- html_dict[template_field] = (
- "<pre><code>" + str(content) + "</pre></code>")
+ html_dict[template_field] = Markup("<pre><code>{}</pre></code>").format(str(content))
Review comment:
Should we add an escape here?
##########
File path: .pre-commit-config.yaml
##########
@@ -246,6 +246,12 @@ metastore_browser/templates/.*\\.html$|.*\\.jinja2"
entry: "pydevd.*settrace\\("
pass_filenames: true
files: \.py$
+ - id: dont-use-safe-filter
+ language: pygrep
+ name: Don't use safe in templates
+ description: the Safe filter is error-prone, use Markup() in code instead
+ entry: "\\|\\s*safe"
+ pass_filenames: true
Review comment:
Should we check only html files?
##########
File path: airflow/www/views.py
##########
@@ -631,11 +630,9 @@ def rendered(self):
for template_field in task.template_fields:
content = getattr(task, template_field)
if template_field in wwwutils.get_attr_renderer():
- html_dict[template_field] = \
- wwwutils.get_attr_renderer()[template_field](content)
+ html_dict[template_field] = wwwutils.get_attr_renderer()[template_field](content)
else:
- html_dict[template_field] = (
- "<pre><code>" + str(content) + "</pre></code>")
+ html_dict[template_field] = Markup("<pre><code>{}</pre></code>").format(str(content))
Review comment:
Should we add an escape here?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org