pallets / markupsafe

Safely add untrusted strings to HTML/XML markup.
https://markupsafe.palletsprojects.com
BSD 3-Clause "New" or "Revised" License
634 stars 156 forks source link

fix exact str check #469

Closed davidism closed 1 month ago

davidism commented 1 month ago

escape checked if o.__class__ is str to skip a cast/copy str(o). However, proxy types that forward attribute access on to the proxied value would report o.__class__ as str, even though they were still the proxy class. This caused the C speedups to fail since they expected to be working with str data at that point. Use type(o) is str instead, which can't be affected by proxies.

fixes #467