search

zopefoundation / z3c.table

Modular table rendering implementation for Zope 3.
Other
0 stars 6 forks source link

more HTML special char escaping needed? #9

Open agroszer opened 5 years ago

agroszer commented 5 years ago

GetAttrColumn.renderCell, GetItemColumn.renderCell and I18nGetAttrColumn.renderCell might need escaping instead of just returning the plain value

mgedmin commented 5 years ago

I will sound like a broken record and suggest looking towards MarkupSafe as a long-term solution for the entire Zope ecosystem.

sgeulette commented 5 years ago

Hello, The last change concerning html escape is breaking functionality. In some case, html not escaped is what we need. I cannot do anymore a span or an img tag in a cell content. I think it's preferable to do escaping in sub methods like getLinkContent by example but not in renderCell. Another solution would be to add a class option to escape or not. Regards

mgedmin commented 5 years ago

This is why I like MarkupSafe: the knowledge whether escaping is needed is tied to the actual data, not decided arbitrarily by some code.