Avoid escaping environ keys that are not used by WSGIHTTPException body_template #139

merged 1 commit into from Jan 29, 2016


None yet

2 participants

amol- commented Mar 13, 2014

Currently WSGIHTTPException, when served as responses, call _make_body to prepare their body.
_make_body gets each entry of the environ and escapes it at https://github.com/Pylons/webob/blob/master/webob/exc.py#L292 if the user stored any property into a previously used request it will end up being in the environ and so will be escaped.

The side effect is that if the user stored any property which the conversion to string fails, the Response will crash even though that property is not used at all.
This is especially true in case you stored your user inside the request (like repoze.who does), the user is an SQLAlchemy model and you rollback the transaction before performing a redirect.

As redirections are subclasses of _HTTPMove (which provides a custom template) the _make_body will iterate on the repoze.who identity, which contains the User and will convert it to string (through html_escape). As transaction has previously been rolled back the user is now detached from the session and so cannot be converted if it provided a custom str/repr method that gets any of its properties.

The proposed patch solves the issue by lazily escaping environ values, so that only those that are used by the body_template are actually evaluated.

@amol- amol- pushed a commit to TurboGears/tg2 that referenced this pull request Apr 24, 2015
Alessandro Molina Make repoze.what Identity unprintable, this also solves Pylons/webob#139
@bertjwregeer bertjwregeer added this to the Version 1.6 milestone Jan 29, 2016
@bertjwregeer bertjwregeer merged commit 9636005 into Pylons:master Jan 29, 2016

1 check passed

default The Travis CI build passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment