Currently WSGIHTTPException, when served as responses, call _make_body to prepare their body.
_make_body gets each entry of the environ and escapes it at https://github.com/Pylons/webob/blob/master/webob/exc.py#L292 if the user stored any property into a previously used request it will end up being in the environ and so will be escaped.
The side effect is that if the user stored any property which the conversion to string fails, the Response will crash even though that property is not used at all.
This is especially true in case you stored your user inside the request (like repoze.who does), the user is an SQLAlchemy model and you rollback the transaction before performing a redirect.
As redirections are subclasses of _HTTPMove (which provides a custom template) the _make_body will iterate on the repoze.who identity, which contains the User and will convert it to string (through html_escape). As transaction has previously been rolled back the user is now detached from the session and so cannot be converted if it provided a custom str/repr method that gets any of its properties.
The proposed patch solves the issue by lazily escaping environ values, so that only those that are used by the body_template are actually evaluated.
Avoid escaping environ keys that are not used by WSGIHTTPException bo…
Make repoze.what Identity unprintable, this also solves Pylons/webob#139
Merge pr '#139' of amol- into bugfix/lazy_escape