Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Values are not URL encoded #12

Open
bladeoflight16 opened this issue Dec 3, 2016 · 3 comments
Open

Values are not URL encoded #12

bladeoflight16 opened this issue Dec 3, 2016 · 3 comments
Labels
beginner-task bug

Comments

@bladeoflight16
Copy link

Flask's url_for function encodes input to be URL safe. For example, url_for('root', someparam='5 & 6 & more') gives back /?someparam=5+%26+6+%26+more.

JSGlue doesn't escape the input at all. Flask.url_for("root", {"someparam": "5 & 6 & more"}) gives back /?someparam=5 & 6 & more.

Here's a fully working demo script:

import flask
from flask_jsglue import JSGlue

app = flask.Flask(__name__)
jsglue = JSGlue(app)
app.debug = True


home_template = u'''
<head>
    {{ JSGlue.include() }}
</head>
<body>
    Flask url: <code>{{ url_for('root', someparam='5 & 6 & more') }}</code>
    <br/>
    JSGlue url: <code id="jsglueurl"></code>

    <script>
        var jsglueUrl = Flask.url_for("root", {"someparam": "5 & 6 & more"});
        document.getElementById("jsglueurl").innerHTML = jsglueUrl;
    </script>
</body>
'''


@app.route("/")
def root():
    return flask.render_template_string(home_template)

if __name__ == "__main__":
    app.run()

You'll see the results on the page.
@bladeoflight16
Copy link
Author

Fixing this may be a breaking change, so it might make sense to make this some kind of setting or argument.

@italomaia
Copy link
Contributor

If safe is expected and you get "unsafe", to me, that's a bug. And probably, not a hard one to fix. Can't think of evil side-effects. @stewartpark what do you think?

@stewartpark
Copy link
Owner

I agree, @italomaia. I think this could be a potential problem and we should replicate whatever Flask's url_for does as much as possible :)

@stewartpark stewartpark mentioned this issue Jul 17, 2017
Open
@stewartpark stewartpark mentioned this issue Nov 18, 2018
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
beginner-task bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@italomaia @stewartpark @bladeoflight16