noahmorrison / chevron

A Python implementation of mustache
MIT License
510 stars 54 forks source link

Version 0.14.0 fails to render sections with names that happen to be builtin methods of `str` #104

Open theister opened 3 years ago

theister commented 3 years ago

All section names that also happen to be names of builtin methods of str to result in broken output if their value is a plain string and not a dictionary.

The example below uses upper as a section name, but the same thing applies to the any function name that can be called as a method of a str object like zfill, encode, endswith, replace, etc.


Minimal example to reproduce (python 3.7, chevron==0.14.0), derived from here by just changing names.

import chevron
chevron.render("{{#upper}}{{{.}}} == {{{upper}}} {{/upper}}", {"upper": "foo"})

Expected output: foo == foo Actual output: foo == <built-in method upper of str object at 0x104383e30>

Version 0.13.1 does not show that behaviour.


It seems that the change in https://github.com/noahmorrison/chevron/pull/87 introduced the bug as a side effect of using getattr() on a variable that isn't guaranteed to not be a string.