Forward port better fix and test for LP #491224 from 2.8 branch.

lib/python/OFS/SimpleItem.py

@@ -33,7 +33,6 @@
 from DocumentTemplate.ustr import ustr
 from ExtensionClass import Base
 from webdav.Resource import Resource
-from webdav.xmltools import escape as xml_escape
 from zExceptions import Redirect
 from zExceptions.ExceptionFormatter import format_exception
 from zope.interface import implements
@@ -230,7 +229,7 @@ def raise_standardErrorMessage(
                     exc_info=True
                     )
                 try:
-                    strv = str(error_value)
+                    strv = repr(error_value) # quotes tainted strings
                 except:
                     strv = ('<unprintable %s object>' %
                             str(type(error_value).__name__))
@@ -240,7 +239,6 @@ def raise_standardErrorMessage(
                      "event log for full details: %s)")%(
                     html_quote(sys.exc_info()[1]),
                     ))
-            v = xml_escape(v)
             raise error_type, v, tb
         finally:
             if hasattr(self, '_v_eek'): del self._v_eek

lib/python/OFS/tests/test_SimpleItem.py

@@ -0,0 +1,51 @@
+import unittest
+
+class ItemTests(unittest.TestCase):
+
+    def _getTargetClass(self):
+        from OFS.SimpleItem import Item
+        return Item
+
+    def _makeOne(self, *args, **kw):
+        return self._getTargetClass()(*args, **kw)
+
+    def test_raise_StandardErrorMessage_str_errorValue(self):
+        item = self._makeOne()
+        def _raise_during_standard_error_message(*args, **kw):
+            raise ZeroDivisionError('testing')
+        item.standard_error_message = _raise_during_standard_error_message
+        try:
+            item.raise_standardErrorMessage(
+                            error_type=OverflowError,
+                            error_value='simple',
+                            REQUEST={'dummy': ''},
+                            )
+        except:
+            import sys
+            self.assertEqual(sys.exc_info()[0], 'OverflowError')
+            value = sys.exc_info()[1]
+            self.failUnless(value.startswith("'simple'"))
+            self.failUnless('full details: testing' in value)
+
+    def test_raise_StandardErrorMessage_TaintedString_errorValue(self):
+        from ZPublisher.TaintedString import TaintedString
+        item = self._makeOne()
+        def _raise_during_standard_error_message(*args, **kw):
+            raise ZeroDivisionError('testing')
+        item.standard_error_message = _raise_during_standard_error_message
+        try:
+            item.raise_standardErrorMessage(
+                            error_type=OverflowError,
+                            error_value=TaintedString('<simple>'),
+                            REQUEST={'dummy': ''},
+                            )
+        except:
+            import sys
+            self.assertEqual(sys.exc_info()[0], 'OverflowError')
+            value = sys.exc_info()[1]
+            self.failIf('<' in value)
+
+def test_suite():
+    return unittest.TestSuite((
+        unittest.makeSuite(ItemTests),
+        ))