Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Isolate interpreter scope when rendering value in striptags filter #1068

Merged
merged 1 commit into from
May 4, 2023

Conversation

mattcoley
Copy link
Collaborator

A bit of a complex bug with a simple solution.

We are seeing an issue where the execution of the striptags value on a String is causing the whole template to fail. I have narrowed it down to the fact that in the striptags filter we execute the Jinjava in the String before escaping the value.

This execution has existed since the initial commit in the repo ee1a3a9

What was missed is that this execution is not scoped. Meaning that any Jinjava inside the striptags argument can pollute the outer context and break the overall rendering. This seems to have been a problem in the early days of Jinjava resulting in some filters implementing the isolated scope pattern (see 1e5f17b) but it appears this filter was missed in that initial fix from 8 years ago.

So here I am 8 years later. We have not come across this issue until recently when a common context variable that commonly has striptags applied to it started including Jinjava frequently. This included Jinjava is polluting the outer scope and causing rendering issues.

@mattcoley mattcoley merged commit 1133893 into master May 4, 2023
@mattcoley mattcoley deleted the isolated-striptags-scope branch May 4, 2023 20:24
@boulter
Copy link
Contributor

boulter commented May 5, 2023

Are there any other filters that could have this problem?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants