New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid escaping environ keys that are not used by WSGIHTTPException body_template #139

Merged
merged 1 commit into from Jan 29, 2016

Conversation

Projects
None yet
2 participants
@amol-
Copy link
Contributor

amol- commented Mar 13, 2014

Currently WSGIHTTPException, when served as responses, call _make_body to prepare their body.
_make_body gets each entry of the environ and escapes it at https://github.com/Pylons/webob/blob/master/webob/exc.py#L292 if the user stored any property into a previously used request it will end up being in the environ and so will be escaped.

The side effect is that if the user stored any property which the conversion to string fails, the Response will crash even though that property is not used at all.
This is especially true in case you stored your user inside the request (like repoze.who does), the user is an SQLAlchemy model and you rollback the transaction before performing a redirect.

As redirections are subclasses of _HTTPMove (which provides a custom template) the _make_body will iterate on the repoze.who identity, which contains the User and will convert it to string (through html_escape). As transaction has previously been rolled back the user is now detached from the session and so cannot be converted if it provided a custom str/repr method that gets any of its properties.

The proposed patch solves the issue by lazily escaping environ values, so that only those that are used by the body_template are actually evaluated.

amol- pushed a commit to TurboGears/tg2 that referenced this pull request Apr 24, 2015

@bertjwregeer bertjwregeer added this to the Version 1.6 milestone Jan 29, 2016

@bertjwregeer bertjwregeer merged commit 9636005 into Pylons:master Jan 29, 2016

1 check passed

default The Travis CI build passed
Details

@pyup-bot pyup-bot referenced this pull request Nov 3, 2017

Closed

Update webob to 1.7.3 #434

@pyup-bot pyup-bot referenced this pull request Jan 26, 2018

Closed

Update webob to 1.7.4 #407

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment