def test_markup_operations(self): # adding two strings should escape the unsafe one unsafe = '<script type="application/x-some-script">alert("foo");</script>' safe = Markup('<em>username</em>') assert unsafe + safe == str(escape(unsafe)) + str(safe) # string interpolations are safe to use too assert Markup('<em>%s</em>') % '<bad user>' == \ '<em><bad user></em>' assert Markup('<em>%(username)s</em>') % { 'username': '******' } == '<em><bad user></em>' # an escaped object is markup too assert type(Markup('foo') + 'bar') is Markup # and it implements __html__ by returning itself x = Markup("foo") assert x.__html__() is x # it also knows how to treat __html__ objects class Foo(object): def __html__(self): return '<em>awesome</em>' def __unicode__(self): return 'awesome' assert Markup(Foo()) == '<em>awesome</em>' assert Markup('<strong>%s</strong>') % Foo() == \ '<strong><em>awesome</em></strong>' # escaping and unescaping assert escape('"<>&\'') == '"<>&'' assert Markup("<em>Foo & Bar</em>").striptags() == "Foo & Bar" assert Markup("<test>").unescape() == "<test>"
def test_markup_operations(self): unsafe = '<script type="application/x-some-script">alert("foo");</script>' safe = Markup('<em>username</em>') x = Markup('foo') class Foo(object): def __html__(self): return '<em>awesome</em>' def __unicode__(self): return 'awesome'
def escape_silent(s): """Like :func:`escape` but converts `None` into an empty markup string. """ if s is None: return Markup() return escape(s)
def escape(s): """Convert the characters &, <, >, ' and " in string s to HTML-safe sequences. Use this if you need to display text that might contain such characters in HTML. Marks return value as markup string. """ if hasattr(s, '__html__'): return s.__html__() return Markup( six.text_type(s).replace('&', '&').replace('>', '>').replace( '<', '<').replace("'", ''').replace('"', '"'))
def test_markup_operations(self): # adding two strings should escape the unsafe one unsafe = '<script type="application/x-some-script">alert("foo");</script>' safe = Markup('<em>username</em>') assert unsafe + safe == unicode(escape(unsafe)) + unicode(safe) # string interpolations are safe to use too assert Markup('<em>%s</em>') % '<bad user>' == \ '<em><bad user></em>' assert Markup('<em>%(username)s</em>') % { 'username': '******' } == '<em><bad user></em>' # an escaped object is markup too assert type(Markup('foo') + 'bar') is Markup # and it implements __html__ by returning itself x = Markup("foo") assert x.__html__() is x # it also knows how to treat __html__ objects class Foo(object): def __html__(self): return '<em>awesome</em>' def __unicode__(self): return 'awesome' assert Markup(Foo()) == '<em>awesome</em>' assert Markup('<strong>%s</strong>') % Foo() == \ '<strong><em>awesome</em></strong>' # escaping and unescaping assert escape('"<>&\'') == '"<>&'' assert Markup("<em>Foo & Bar</em>").striptags() == "Foo & Bar" assert Markup("<test>").unescape() == "<test>"
def test_escape_silent(self): assert escape_silent(None) == Markup() assert escape(None) == Markup(None) assert escape_silent('<foo>') == Markup(u'<foo>')
def _json_escaped(value): return Markup(json.dumps(value))
def escape(s): if hasattr(s, '__html__'): return s.__html__() return Markup( unicode(s).replace('&', '&').replace('>', '>').replace( '<', '<').replace("'", ''').replace('"', '"'))
def escape_silent(s): if s is None: return Markup() return escape(s)
def providers_media_js(context): request = context['request'] ret = '\n'.join([p.media_js(request) for p in providers.registry.get_list()]) return Markup(ret)
def nl2br(value): if value: return Markup(cgi.escape(value).replace('\n', '<br>\n')) return value
def urlencode_filter(s): if type(s) == 'Markup': s = s.unescape() s = s.encode('utf8') s = urllib.quote_plus(s) return Markup(s)