diff --git a/docs/templates_python.txt b/docs/templates_python.txt index e4658f6461..5ac93f5a58 100644 --- a/docs/templates_python.txt +++ b/docs/templates_python.txt @@ -755,61 +755,106 @@ inside the template code: ``EscapeString`` and ``EscapeUnicode``. You will not normally need to worry about these; they exist for the implementation of the ``escape`` filter. -Inside your filter, you will need to think about three areas in order to be -auto-escaping compliant: +When you are writing a filter, your code will typically fall into one of two +situations: - 1. If your filter returns a string that is ready for direct output (it should - be considered a "safe" string), you should call - ``django.utils.safestring.mark_safe()`` on the result prior to returning. - This will turn the result into the appropriate ``SafeData`` type. This is - often the case when you are returning raw HTML, for example. + 1. Your filter does not introduce any HTML-unsafe characters (``<``, ``>``, + ``'``, ``"`` or ``&``) into the result that were not already present. In + this case, you can let Django take care of all the auto-escaping handling + for you. All you need to do is put the ``is_safe`` attribute on your + filter function and set it to ``True``. This attribute tells Django that + is a "safe" string is passed into your filter, the result will still be + "safe" and if a non-safe string is passed in, Django will automatically + escape it, if necessary. The reason ``is_safe`` is necessary is because + there are plenty of normal string operations that will turn a ``SafeData`` + object back into a normal ``str`` or ``unicode`` object and, rather than + try to catch them all, which would be very difficult, Django repairs the + damage after the filter has completed. - 2. If your filter is given a "safe" string, is it guaranteed to return a - "safe" string? If so, set the ``is_safe`` attribute on the function to be - ``True``. For example, a filter that replaced a word consisting only of - digits with the number spelt out in words is going to be - safe-string-preserving, since it cannot introduce any of the five dangerous - characters: <, >, ", ' or &. We can write:: + For example, suppose you have a filter that adds the string ``xx`` to the + end of any input. Since this introduces no dangerous HTML characters into + the result (aside from any that were already present), you should mark + your filter with ``is_safe``:: @register.filter - def convert_to_words(value): - # ... implementation here ... - return result + def add_xx(value): + return '%sxx' % value + add_xx.is_safe = True - convert_to_words.is_safe = True + When this filter is used in a template where auto-escaping is enabled, + Django will escape the output whenever the input is not already marked as + "safe". - Note that this filter does not return a universally safe result (it does - not return ``mark_safe(result)``) because if it is handed a raw string such - as '', this will need further escaping in an auto-escape environment. - The ``is_safe`` attribute only talks about the the result when a safe - string is passed into the filter. + By default, ``is_safe`` defaults to ``False`` and you can omit it from + any filters where it isn't required. - 3. Will your filter behave differently depending upon whether auto-escaping - is currently in effect or not? This is normally a concern when you are - returning mixed content (HTML elements mixed with user-supplied content). - For example, the ``ordered_list`` filter that ships with Django needs to - know whether to escape its content or not. It will always return a safe - string. Since it returns raw HTML, we cannot apply escaping to the - result -- it needs to be done in-situ. + Be careful when deciding if your filter really does leave safe strings + as safe. Sometimes if you are *removing* characters, you can + inadvertently leave unbalanced HTML tags or entities in the result. + For example, removing a ``>`` from the input might turn ```` into + ``