2015-01-28 12:35:27 +00:00
|
|
|
from django.template import Context, Template
|
2016-12-31 17:43:30 +00:00
|
|
|
from django.test import SimpleTestCase
|
2016-12-29 15:27:49 +00:00
|
|
|
from django.utils import html, text
|
2017-01-30 14:17:39 +00:00
|
|
|
from django.utils.functional import lazy, lazystr
|
2016-12-31 17:43:30 +00:00
|
|
|
from django.utils.safestring import SafeData, mark_safe
|
2013-04-20 11:38:14 +00:00
|
|
|
|
|
|
|
|
|
2016-12-29 15:27:49 +00:00
|
|
|
class customescape(str):
|
2014-12-23 21:29:01 +00:00
|
|
|
def __html__(self):
|
|
|
|
|
# implement specific and obviously wrong escaping
|
|
|
|
|
# in order to be able to tell for sure when it runs
|
|
|
|
|
return self.replace('<', '<<').replace('>', '>>')
|
|
|
|
|
|
|
|
|
|
|
2015-04-17 21:38:20 +00:00
|
|
|
class SafeStringTest(SimpleTestCase):
|
2013-04-20 11:38:14 +00:00
|
|
|
def assertRenderEqual(self, tpl, expected, **context):
|
|
|
|
|
context = Context(context)
|
|
|
|
|
tpl = Template(tpl)
|
|
|
|
|
self.assertEqual(tpl.render(context), expected)
|
|
|
|
|
|
|
|
|
|
def test_mark_safe(self):
|
|
|
|
|
s = mark_safe('a&b')
|
|
|
|
|
|
|
|
|
|
self.assertRenderEqual('{{ s }}', 'a&b', s=s)
|
|
|
|
|
self.assertRenderEqual('{{ s|force_escape }}', 'a&b', s=s)
|
|
|
|
|
|
2017-01-30 18:15:59 +00:00
|
|
|
def test_mark_safe_str(self):
|
|
|
|
|
"""
|
|
|
|
|
Calling str() on a SafeText instance doesn't lose the safe status.
|
|
|
|
|
"""
|
|
|
|
|
s = mark_safe('a&b')
|
|
|
|
|
self.assertIsInstance(str(s), type(s))
|
|
|
|
|
|
2014-12-23 21:29:01 +00:00
|
|
|
def test_mark_safe_object_implementing_dunder_html(self):
|
|
|
|
|
e = customescape('<a&b>')
|
|
|
|
|
s = mark_safe(e)
|
|
|
|
|
self.assertIs(s, e)
|
|
|
|
|
|
|
|
|
|
self.assertRenderEqual('{{ s }}', '<<a&b>>', s=s)
|
|
|
|
|
self.assertRenderEqual('{{ s|force_escape }}', '<a&b>', s=s)
|
|
|
|
|
|
2013-04-20 11:38:14 +00:00
|
|
|
def test_mark_safe_lazy(self):
|
|
|
|
|
s = lazystr('a&b')
|
|
|
|
|
|
2014-02-05 04:16:39 +00:00
|
|
|
self.assertIsInstance(mark_safe(s), SafeData)
|
2013-04-20 11:38:14 +00:00
|
|
|
self.assertRenderEqual('{{ s }}', 'a&b', s=mark_safe(s))
|
|
|
|
|
|
2014-12-23 20:49:05 +00:00
|
|
|
def test_mark_safe_object_implementing_dunder_str(self):
|
2017-01-19 07:39:46 +00:00
|
|
|
class Obj:
|
2014-12-23 20:49:05 +00:00
|
|
|
def __str__(self):
|
|
|
|
|
return '<obj>'
|
|
|
|
|
|
|
|
|
|
s = mark_safe(Obj())
|
|
|
|
|
|
|
|
|
|
self.assertRenderEqual('{{ s }}', '<obj>', s=s)
|
|
|
|
|
|
2014-12-23 21:29:01 +00:00
|
|
|
def test_mark_safe_result_implements_dunder_html(self):
|
|
|
|
|
self.assertEqual(mark_safe('a&b').__html__(), 'a&b')
|
|
|
|
|
|
|
|
|
|
def test_mark_safe_lazy_result_implements_dunder_html(self):
|
|
|
|
|
self.assertEqual(mark_safe(lazystr('a&b')).__html__(), 'a&b')
|
|
|
|
|
|
2014-10-16 01:03:40 +00:00
|
|
|
def test_add_lazy_safe_text_and_safe_text(self):
|
|
|
|
|
s = html.escape(lazystr('a'))
|
|
|
|
|
s += mark_safe('&b')
|
|
|
|
|
self.assertRenderEqual('{{ s }}', 'a&b', s=s)
|
|
|
|
|
|
|
|
|
|
s = html.escapejs(lazystr('a'))
|
|
|
|
|
s += mark_safe('&b')
|
|
|
|
|
self.assertRenderEqual('{{ s }}', 'a&b', s=s)
|
|
|
|
|
|
|
|
|
|
s = text.slugify(lazystr('a'))
|
|
|
|
|
s += mark_safe('&b')
|
|
|
|
|
self.assertRenderEqual('{{ s }}', 'a&b', s=s)
|
2016-06-02 21:11:43 +00:00
|
|
|
|
|
|
|
|
def test_mark_safe_as_decorator(self):
|
|
|
|
|
"""
|
|
|
|
|
mark_safe used as a decorator leaves the result of a function
|
|
|
|
|
unchanged.
|
|
|
|
|
"""
|
|
|
|
|
def clean_string_provider():
|
|
|
|
|
return '<html><body>dummy</body></html>'
|
|
|
|
|
|
|
|
|
|
self.assertEqual(mark_safe(clean_string_provider)(), clean_string_provider())
|
|
|
|
|
|
|
|
|
|
def test_mark_safe_decorator_does_not_affect_dunder_html(self):
|
|
|
|
|
"""
|
|
|
|
|
mark_safe doesn't affect a callable that has an __html__() method.
|
|
|
|
|
"""
|
|
|
|
|
class SafeStringContainer:
|
|
|
|
|
def __html__(self):
|
|
|
|
|
return '<html></html>'
|
|
|
|
|
|
|
|
|
|
self.assertIs(mark_safe(SafeStringContainer), SafeStringContainer)
|
|
|
|
|
|
|
|
|
|
def test_mark_safe_decorator_does_not_affect_promises(self):
|
|
|
|
|
"""
|
|
|
|
|
mark_safe doesn't affect lazy strings (Promise objects).
|
|
|
|
|
"""
|
|
|
|
|
def html_str():
|
|
|
|
|
return '<html></html>'
|
|
|
|
|
|
|
|
|
|
lazy_str = lazy(html_str, str)()
|
|
|
|
|
self.assertEqual(mark_safe(lazy_str), html_str())
|
