Avoid escaping environ keys that are not used by WSGIHTTPException body_template #139
Conversation
amol-
pushed a commit
to TurboGears/tg2
that referenced
this pull request
Apr 24, 2015
bertjwregeer
added a commit
that referenced
this pull request
Jan 29, 2016
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Currently WSGIHTTPException, when served as responses, call _make_body to prepare their body.
_make_body gets each entry of the environ and escapes it at https://github.com/Pylons/webob/blob/master/webob/exc.py#L292 if the user stored any property into a previously used request it will end up being in the environ and so will be escaped.
The side effect is that if the user stored any property which the conversion to string fails, the Response will crash even though that property is not used at all.
This is especially true in case you stored your user inside the request (like repoze.who does), the user is an SQLAlchemy model and you rollback the transaction before performing a redirect.
As redirections are subclasses of _HTTPMove (which provides a custom template) the _make_body will iterate on the repoze.who identity, which contains the User and will convert it to string (through html_escape). As transaction has previously been rolled back the user is now detached from the session and so cannot be converted if it provided a custom str/repr method that gets any of its properties.
The proposed patch solves the issue by lazily escaping environ values, so that only those that are used by the body_template are actually evaluated.