mirror of
https://github.com/astral-sh/ruff.git
synced 2025-10-01 14:21:53 +00:00
4da6936ec4
## Summary Stop flagging each invocation of `django.utils.safestring.mark_safe` (also available at, `django.utils.html.mark_safe`) as an error. Instead, allow string literals as valid uses for `mark_safe`. Also, update the documentation, pointing at `django.utils.html.format_html` for dynamic content generation use cases. Closes #16702 ## Test Plan I verified several possible uses, but string literals, are still flagged. --------- Co-authored-by: Micha Reiser <micha@reiser.io>
43 lines
1,014 B
Python
43 lines
1,014 B
Python
from django.utils.safestring import mark_safe
|
|
|
|
|
|
def bad_func():
|
|
inject = "harmful_input"
|
|
mark_safe(inject)
|
|
mark_safe("I will add" + inject + "to my string")
|
|
mark_safe("I will add %s to my string" % inject)
|
|
mark_safe("I will add {} to my string".format(inject))
|
|
mark_safe(f"I will add {inject} to my string")
|
|
|
|
def good_func():
|
|
mark_safe("I won't inject anything")
|
|
|
|
|
|
@mark_safe
|
|
def some_func():
|
|
return '<script>alert("evil!")</script>'
|
|
|
|
|
|
from django.utils.html import mark_safe
|
|
|
|
|
|
def bad_func():
|
|
inject = "harmful_input"
|
|
mark_safe(inject)
|
|
mark_safe("I will add" + inject + "to my string")
|
|
mark_safe("I will add %s to my string" % inject)
|
|
mark_safe("I will add {} to my string".format(inject))
|
|
mark_safe(f"I will add {inject} to my string")
|
|
|
|
def good_func():
|
|
mark_safe("I won't inject anything")
|
|
|
|
|
|
@mark_safe
|
|
def some_func():
|
|
return '<script>alert("evil!")</script>'
|
|
|
|
|
|
# https://github.com/astral-sh/ruff/issues/15522
|
|
map(mark_safe, [])
|
|
foo = mark_safe
|