Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
key.type))
item.i18n_title = resource_handler.get_i18n_title(key)
except AssertionError:
# Not all news things are backed by AbstractResourceHandler types.
# Fall back to news-specific registry for these.
resource_handler = I18nTitleRegistry
key_type, _ = item.resource_key.split(resource.Key.SEPARATOR, 1)
item.i18n_title = resource_handler.get_i18n_title(
key_type, item.resource_key)
# Fill template
template_environ = app_context.get_template_environ(
app_context.get_current_locale(), [TEMPLATES_DIR])
template = template_environ.get_template('news.html', [TEMPLATES_DIR])
return [
jinja2.utils.Markup(template.render({'news': news}, autoescape=True))]
def markup_join(seq):
"""Concatenation that escapes if necessary and converts to unicode."""
buf = []
iterator = imap(soft_unicode, seq)
for arg in iterator:
buf.append(arg)
if hasattr(arg, '__html__'):
return Markup(u'').join(chain(buf, iterator))
return concat(buf)
@contextfunction
def ngettext(__context, __singular, __plural, __num, **variables):
variables.setdefault('num', __num)
rv = __context.call(func, __singular, __plural, __num)
if __context.eval_ctx.autoescape:
rv = Markup(rv)
return rv % variables
return ngettext
def do_mark_safe(value):
"""Mark the value as safe which means that in an environment with automatic
escaping enabled this variable will not be escaped.
"""
return Markup(value)
{{ mytext|urlize(40, true) }}
links are shortened to 40 chars and defined with rel="nofollow"
If *target* is specified, the ``target`` attribute will be added to the
``<a>`` tag:
.. sourcecode:: jinja
{{ mytext|urlize(40, target='_blank') }}
.. versionchanged:: 2.8+
The *target* parameter was added.
"""
rv = urlize(value, trim_url_limit, nofollow, target)
if eval_ctx.autoescape:
rv = Markup(rv)
return rv
</a>
jinja2._markupsafe.escape = utf8escape
except AttributeError:
pass
jinja2.runtime.escape = utf8escape
jinja2.utils.escape = utf8escape
jinja2.filters.escape = utf8escape
jinja2.compiler.escape = utf8escape
jinja2.escape = utf8escape
# Markup class replacement in Jinja2 library
try:
jinja2._markupsafe.Markup = Markup
except AttributeError:
pass
jinja2.runtime.Markup = Markup
jinja2.utils.Markup = Markup
jinja2.filters.Markup = Markup
jinja2.compiler.Markup = Markup
jinja2.Markup = Markup
jinja2.nodes.Markup = Markup
jinja2.ext.Markup = Markup
jinja2.environment.Markup = Markup
# Escape/Markup replacement in MarkupSafe library.
# FIXME causes recursive calls in `Markup.__new__` and `escape`
# try:
# import markupsafe
# markupsafe.escape = utf8escape
# #markupsafe.Markup = Markup
# except ImportError:
# pass
def bind(value, name):
"""A filter that prints %s, and stores the value
in an array, so that it can be bound using a prepared statement
This filter is automatically applied to every {{variable}}
during the lexing stage, so developers can't forget to bind
"""
if isinstance(value, Markup):
return value
elif requires_in_clause(value):
raise MissingInClauseException("""Got a list or tuple.
Did you forget to apply '|inclause' to your query?""")
else:
return _bind_param(_thread_local.bind_params, name, value)
def format_string(self, s, args, kwargs):
"""If a format call is detected, then this is routed through this
method so that our safety sandbox can be used for it.
"""
if isinstance(s, Markup):
formatter = SandboxedEscapeFormatter(self, s.escape)
else:
formatter = SandboxedFormatter(self)
kwargs = _MagicFormatMapping(args, kwargs)
rv = formatter.vformat(s, args, kwargs)
return type(s)(rv)
def _invoke(self, arguments, autoescape):
"""This method is being swapped out by the async implementation."""
rv = self._func(*arguments)
if autoescape:
rv = Markup(rv)
return rv
def has_safe_repr(value):
"""Does the node have a safe representation?"""
if value is None or value is NotImplemented or value is Ellipsis:
return True
if type(value) in (bool, int, float, complex, range_type, Markup) + string_types:
return True
if type(value) in (tuple, list, set, frozenset):
for item in value:
if not has_safe_repr(item):
return False
return True
elif type(value) is dict:
for key, value in iteritems(value):
if not has_safe_repr(key):
return False
if not has_safe_repr(value):
return False
return True
return False