root
/
flask
mirror of https://github.com/pallets/flask.git
1
0
Fork 0
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Add .svg to select_jinja_autoescape (#4840) 

As SVG files are a type of XML file and are similar in nearly
all aspects to XML, .svg should also be autoescaped.
This commit is contained in:
Jonah Lawrence 2022-10-30 07:55:51 -07:00 committed by David Lord
parent 631b6dd546
commit 79032ca5f1
No known key found for this signature in database
GPG Key ID: 7A1C87E3F5BC42A8
3 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES.rst
View File

@ -3,6 +3,9 @@ Version 2.2.3
Unreleased Unreleased
- Autoescaping is now enabled by default for ``.svg`` files. Inside
templates this behavior can be changed with the ``autoescape`` tag.
:issue:`4831`
- Fix the type of ``template_folder`` to accept ``pathlib.Path``. :issue:`4892` - Fix the type of ``template_folder`` to accept ``pathlib.Path``. :issue:`4892`

2
docs/templating.rst
View File

@ -18,7 +18,7 @@ Jinja Setup
Unless customized, Jinja2 is configured by Flask as follows: Unless customized, Jinja2 is configured by Flask as follows:
- autoescaping is enabled for all templates ending in ``.html``, - autoescaping is enabled for all templates ending in ``.html``,
``.htm``, ``.xml`` as well as ``.xhtml`` when using ``.htm``, ``.xml``, ``.xhtml``, as well as ``.svg`` when using
:func:`~flask.templating.render_template`. :func:`~flask.templating.render_template`.
- autoescaping is enabled for all strings when using - autoescaping is enabled for all strings when using
:func:`~flask.templating.render_template_string`. :func:`~flask.templating.render_template_string`.

5
src/flask/app.py
View File

@ -961,11 +961,14 @@ class Flask(Scaffold):
"""Returns ``True`` if autoescaping should be active for the given """Returns ``True`` if autoescaping should be active for the given
template name. If no template name is given, returns `True`. template name. If no template name is given, returns `True`.
.. versionchanged:: 2.2
Autoescaping is now enabled by default for ``.svg`` files.
.. versionadded:: 0.5 .. versionadded:: 0.5
""" """
if filename is None: if filename is None:
return True return True
return filename.endswith((".html", ".htm", ".xml", ".xhtml")) return filename.endswith((".html", ".htm", ".xml", ".xhtml", ".svg"))
def update_template_context(self, context: dict) -> None: def update_template_context(self, context: dict) -> None:
"""Update the template context with some commonly used variables. """Update the template context with some commonly used variables.