escape special HTML chars

[agroszer]

I'm very tempted to add escape also to GetAttrColumn.renderCell, GetItemColumn.renderCell and I18nGetAttrColumn.renderCell

opinions? anyone?

[mgedmin]

I'm woefully out of context, but IMnsHO all of zopefoundation stuff should start using MarkupSafe ASAP and make escaping mistakes impossible (or at least harmless).

[agroszer]

Well the problem was simple, someone added a content object with the __name__ = '14" monitor' selecting with the checkbox silently did not work...
This is the 'quick' fix for it, I don't think switching all of zopefoundation stuff and our code is within easy reach.
OTOH most zopefoundation stuff that uses ZPT/TAL is much safer because there you need to do extra work to NOT get escaped strings. Maybe z3c.table gets it wrong by doing direct string operations?

Anyway, merge or change something?

[mgedmin]

I'm feeling a bit +0 for this. It's confusing which methods are expected to return raw HTML, and which methods can safely return user input without worrying about escaping. And almost none of that is documented in the interface docstrings.

(This is one of the reasons I like MarkupSafe so much: the escaped/raw decision belongs with the data, not in hidden assumptions about method calling conventions.)

[mgedmin]

Thank you!