我们从Python开源项目中，提取了以下32个代码示例，用于说明如何使用jinja2.escape()。
def variables(self, form): try: if request.method == 'POST': data = request.json if data: with create_session() as session: var = models.Variable(key=form, val=json.dumps(data)) session.add(var) session.commit() return "" else: return self.render( 'airflow/variables/{}.html'.format(form) ) except: # prevent XSS form = escape(form) return ("Error: form airflow/variables/{}.html " "not found.").format(form), 404
def nl2br(eval_ctx, value): result = u'\n\n'.join(u'<p>%s</p>' % p.replace('\n', '<br>\n') \ for p in _paragraph_re.split(escape(value))) if eval_ctx.autoescape: result = Markup(result) return result
def newline_br(eval_ctx, value): result = u'\n\n'.join(u'<p>%s</p>' % p.replace('\n', '<br>\n') \ for p in _paragraph_re.split(escape(value))) if eval_ctx.autoescape: result = Markup(result) return result
def test_markup_operations(self): # adding two strings should escape the unsafe one unsafe = '<script type="application/x-some-script">alert("foo");</script>' safe = Markup('<em>username</em>') assert unsafe + safe == text_type(escape(unsafe)) + text_type(safe) # string interpolations are safe to use too assert Markup('<em>%s</em>') % '<bad user>' == \ '<em><bad user></em>' assert Markup('<em>%(username)s</em>') % { 'username': '<bad user>' } == '<em><bad user></em>' # an escaped object is markup too assert type(Markup('foo') + 'bar') is Markup # and it implements __html__ by returning itself x = Markup("foo") assert x.__html__() is x # it also knows how to treat __html__ objects class Foo(object): def __html__(self): return '<em>awesome</em>' def __unicode__(self): return 'awesome' assert Markup(Foo()) == '<em>awesome</em>' assert Markup('<strong>%s</strong>') % Foo() == \ '<strong><em>awesome</em></strong>' # escaping and unescaping assert escape('"<>&\'') == '"<>&'' assert Markup("<em>Foo & Bar</em>").striptags() == "Foo & Bar" assert Markup("<test>").unescape() == "<test>"
def test_template_data(self): env = Environment(autoescape=True) t = env.from_string('{% macro say_hello(name) %}' '<p>Hello {{ name }}!</p>{% endmacro %}' '{{ say_hello("<blink>foo</blink>") }}') escaped_out = '<p>Hello <blink>foo</blink>!</p>' assert t.render() == escaped_out assert text_type(t.module) == escaped_out assert escape(t.module) == escaped_out assert t.module.say_hello('<blink>foo</blink>') == escaped_out assert escape(t.module.say_hello('<blink>foo</blink>')) == escaped_out
def nl2br(text): markup = jinja2.escape(text) return jinja2.Markup('<br>'.join(markup.split('\n')))
def hidden_tag(self, *fields): """ Wraps hidden fields in a hidden DIV tag, in order to keep XHTML compliance. .. versionadded:: 0.3 :param fields: list of hidden field names. If not provided will render all hidden fields, including the CSRF field. """ if not fields: fields = [f for f in self if _is_hidden(f)] name = current_app.config.get('WTF_HIDDEN_TAG', 'div') attrs = current_app.config.get( 'WTF_HIDDEN_TAG_ATTRS', {'style': 'display:none;'}) tag_attrs = u' '.join( u'%s="%s"' % (escape(k), escape(v)) for k, v in attrs.items()) tag_start = u'<%s %s>' % (escape(name), tag_attrs) tag_end = u'</%s>' % escape(name) rv = [tag_start] for field in fields: if isinstance(field, string_types): field = getattr(self, field) rv.append(text_type(field)) rv.append(tag_end) return Markup(u"".join(rv))
def json_and_html_safe(data): if isinstance(data, str): return escape(data.replace('\\', r'\\')) return data
def format_multilined_string(context, value): escaped_value = escape(value) new_line_regex = r'(?:\r\n|\r|\n)+' value_with_line_break_tag = re.sub(new_line_regex, '<br>', escaped_value) result = '<p>{}</p>'.format(value_with_line_break_tag) if context.autoescape: return Markup(result) return result
def escaped(self): """ Escape all answer values and return a new AnswerStore instance. :return: Return a new AnswerStore object with escaped answers for chaining """ escaped = [] for answer in self.answers: answer = answer.copy() if isinstance(answer['value'], str): answer['value'] = escape(answer['value']) escaped.append(answer) return self.__class__(existing_answers=escaped)
def nl2br(eval_ctx, value): _paragraph_re = re.compile(r'(?:\r\n|\r|\n){2,}') result = u'\n\n'.join(u'<p>%s</p>' % p.replace('\n', '<br>\n') \ for p in _paragraph_re.split(escape(value))) if eval_ctx.autoescape: result = Markup(result) return result
def test_monkey_patch(): form = MyForm() html = form.as_ul() context = {'form': form} t = '{{ form.as_ul() }}' eq_(escape(html), render(t, context)) jingo.monkey.patch() eq_(html, render(t, context)) s = six.text_type(form['email']) eq_(s, render('{{ form.email }}', {'form': form}))
def fe(s, *args, **kwargs): """Format a safe string with potentially unsafe arguments, then return a safe string.""" s = six.text_type(s) args = [jinja2.escape(smart_text(v)) for v in args] for k in kwargs: kwargs[k] = jinja2.escape(smart_text(kwargs[k])) return jinja2.Markup(s.format(*args, **kwargs))
def nl2br(string): """Turn newlines into <br>.""" if not string: return '' return jinja2.Markup('<br>'.join(jinja2.escape(string).splitlines()))
def nl2br_template_filter(eval_ctx, value): if value is None: return '' value = escape(value) value = value.replace('\n', Markup('<br />\n')) if eval_ctx.autoescape: value = Markup(value) return value
