Escape dictionary curly bracket before renderingin HTML

[chadell]

Addresses issue #41

[glennmatthews]

I'm not sure this is the "best" solution to the issue - I'm concerned that it seems like we're double-interpreting a variable value somewhere in here, and this is maybe only a bandaid over a more fundamental design issue. Might be worth looking at how render_diff is wrapping this text into format_html() and see if that needs to be revisited somehow instead.

[chadell]

The result that we send to format_html(result) contains this HTML: <li class="diff-added">cfs: {'asw_owner': ''}</li>

>>> from django.utils.html import format_html
>>> result = "<li class='diff-added'>cfs: {'asw_owner': ''}</li>"
>>> format_html(result)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.6/site-packages/django/utils/html.py", line 115, in format_html
    return mark_safe(format_string.format(*args_safe, **kwargs_safe))
KeyError: "'asw_owner'"

From docs, format_html(format_string, *args, **kwargs) takes that as a format string.
So, my suggestion would be to start using mark_safe instead.

[chadell]

Any concern/idea about bandit issue with cross-site scripting?

[glennmatthews]

Any concern/idea about bandit issue with cross-site scripting?

Could certainly try a test or two with objects in the diff whose string representation is HTML or JS?

[chadell]

In 6e3c3c0 I replaced all the f-strings with input data by format_html what enforces escape to protect against XSS, and then when we reused this "safe" HTML code, we use the mark_safe to not escape it again.

[glennmatthews]

Can we have a unit test case or two get added for render_diff? Otherwise looks good to me!