diff --git a/CHANGES.rst b/CHANGES.rst index 77d2dff..2dc1a2d 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -1,3 +1,7 @@ +0.5.7 (2018-11-07) +------------------ +- Render can now autoescape context dict + 0.5.6 (2018-10-18) ------------------ - Fix invalid xml parse because using {% vm %} diff --git a/docs/index.rst b/docs/index.rst index 7d6a1b1..03aaef9 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -159,11 +159,12 @@ Escaping, newline, new paragraph, Listing ----------------------------------------- When you use a ``{{ }}``, you are modifying an **XML** word document, this means you cannot use all chars, -especially ``<``, ``>`` and ``&``. In order to use them, you must escape them. There are 3 ways : +especially ``<``, ``>`` and ``&``. In order to use them, you must escape them. There are 4 ways : * ``context = { 'var':R('my text') }`` and ``{{r }}`` in the template (note the ``r``), * ``context = { 'var':'my text'}`` and ``{{ |e }}`` in your word template * ``context = { 'var':escape('my text')}`` and ``{{ }}`` in the template. + * enable autoescaping when calling render method: ``tpl.render(context, autoescape=True)`` (default is autoescape=False) The ``RichText()`` or ``R()`` offers newline and new paragraph feature : just use ``\n`` or ``\a`` in the text, they will be converted accordingly. diff --git a/docxtpl/__init__.py b/docxtpl/__init__.py index c20bdc1..6d245be 100644 --- a/docxtpl/__init__.py +++ b/docxtpl/__init__.py @@ -5,7 +5,7 @@ Created : 2015-03-12 @author: Eric Lapouyade ''' -__version__ = '0.5.6' +__version__ = '0.5.7' from lxml import etree from docx import Document @@ -15,7 +15,7 @@ from docx.opc.constants import RELATIONSHIP_TYPE as REL_TYPE from jinja2 import Template from jinja2.exceptions import TemplateError try: - from html import escape + from html import escape, unescape except ImportError: # cgi.escape is deprecated in python 3.7 from cgi import escape @@ -24,6 +24,7 @@ import six import binascii import os import zipfile +import sys NEWLINE_XML = '' NEWPARAGRAPH_XML = '' @@ -169,7 +170,43 @@ class DocxTemplate(object): def map_headers_footers_xml(self, relKey, xml): self.docx._part._rels[relKey]._target._blob = xml - def render(self,context,jinja_env=None): + @staticmethod + def escape_values(context): + """Escape strings for an XML Word document + which may contain <, >, &, ', and ". + """ + def escape_recursively(d): + """Escape string values of the passed :dict: `d` in-place + including nested dictionaries. + """ + nonlocal hash_values + + for k, v in d.items(): + if isinstance(v, dict): + hash_value = id(v) + if hash_value not in hash_values: + hash_values.add(hash_value) + escape_recursively(v) + else: + # Avoid dict, Listing, InlineImage, RichText, etc. classes + # by comparing v to str. Do not use try-except. + if isinstance(v, str): + # Unescape at first to avoid secondary escaping + d[k] = escape(unescape(v)) + + # Avoid RecursionError (if back edges, i.e. cycles, exist) + # by using a set of hash values of iterated dictionaries. + hash_values = {id(context), } + + escape_recursively(context) + + def render(self, context, jinja_env=None, autoescape=False): + if sys.version_info >= (3, 0) and autoescape: + self.escape_values(context) + else: + # Sorry folk, use awesome Python3 such as 3.6 + pass + # Body xml_src = self.build_xml(context,jinja_env) diff --git a/tests/escape_auto.py b/tests/escape_auto.py new file mode 100644 index 0000000..d792fc2 --- /dev/null +++ b/tests/escape_auto.py @@ -0,0 +1,13 @@ +from docxtpl import * + +tpl = DocxTemplate("test_files/escape_tpl_auto.docx") + +context = {'myvar': R('"less than" must be escaped : <, this can be done with RichText() or R()'), + 'myescvar':'It can be escaped with a "|e" jinja filter in the template too : < ', + 'nlnp' : R('Here is a multiple\nlines\nstring\aand some\aother\aparagraphs\aNOTE: the current character styling is removed'), + 'mylisting': Listing('the listing\nwith\nsome\nlines\nand special chars : <>&'), + 'autoescape': """These string should be auto escaped for an XML Word document which may contain <, >, &, ", and '.""" + } + +tpl.render(context, autoescape=True) +tpl.save("test_files/escape_auto.docx") diff --git a/tests/test_files/cellbg.docx b/tests/test_files/cellbg.docx index eb27105..a01362a 100644 Binary files a/tests/test_files/cellbg.docx and b/tests/test_files/cellbg.docx differ diff --git a/tests/test_files/dynamic_table.docx b/tests/test_files/dynamic_table.docx index d1f56b6..ea013cd 100644 Binary files a/tests/test_files/dynamic_table.docx and b/tests/test_files/dynamic_table.docx differ diff --git a/tests/test_files/embedded.docx b/tests/test_files/embedded.docx index f6887d7..014caff 100644 Binary files a/tests/test_files/embedded.docx and b/tests/test_files/embedded.docx differ diff --git a/tests/test_files/embedded_embedded_docx.docx b/tests/test_files/embedded_embedded_docx.docx index 31e66af..078b21c 100644 Binary files a/tests/test_files/embedded_embedded_docx.docx and b/tests/test_files/embedded_embedded_docx.docx differ diff --git a/tests/test_files/escape.docx b/tests/test_files/escape.docx index 52c8319..10e6e8c 100644 Binary files a/tests/test_files/escape.docx and b/tests/test_files/escape.docx differ diff --git a/tests/test_files/escape_auto.docx b/tests/test_files/escape_auto.docx new file mode 100644 index 0000000..fc0e54c Binary files /dev/null and b/tests/test_files/escape_auto.docx differ diff --git a/tests/test_files/escape_tpl_auto.docx b/tests/test_files/escape_tpl_auto.docx new file mode 100644 index 0000000..c6f7a6c Binary files /dev/null and b/tests/test_files/escape_tpl_auto.docx differ diff --git a/tests/test_files/header_footer.docx b/tests/test_files/header_footer.docx index ed9f331..cb3051f 100644 Binary files a/tests/test_files/header_footer.docx and b/tests/test_files/header_footer.docx differ diff --git a/tests/test_files/header_footer_entities.docx b/tests/test_files/header_footer_entities.docx index 99e1500..f9b286f 100644 Binary files a/tests/test_files/header_footer_entities.docx and b/tests/test_files/header_footer_entities.docx differ diff --git a/tests/test_files/header_footer_image.docx b/tests/test_files/header_footer_image.docx index 5e81a66..99778de 100644 Binary files a/tests/test_files/header_footer_image.docx and b/tests/test_files/header_footer_image.docx differ diff --git a/tests/test_files/header_footer_utf8.docx b/tests/test_files/header_footer_utf8.docx index 0610150..903616a 100644 Binary files a/tests/test_files/header_footer_utf8.docx and b/tests/test_files/header_footer_utf8.docx differ diff --git a/tests/test_files/inline_image.docx b/tests/test_files/inline_image.docx index 5cefe05..b2f0204 100644 Binary files a/tests/test_files/inline_image.docx and b/tests/test_files/inline_image.docx differ diff --git a/tests/test_files/nested_for.docx b/tests/test_files/nested_for.docx index a9587bf..569b5e3 100644 Binary files a/tests/test_files/nested_for.docx and b/tests/test_files/nested_for.docx differ diff --git a/tests/test_files/order.docx b/tests/test_files/order.docx index f94654c..a4b9eda 100644 Binary files a/tests/test_files/order.docx and b/tests/test_files/order.docx differ diff --git a/tests/test_files/replace_picture.docx b/tests/test_files/replace_picture.docx index 543160c..ba8a13e 100644 Binary files a/tests/test_files/replace_picture.docx and b/tests/test_files/replace_picture.docx differ diff --git a/tests/test_files/richtext.docx b/tests/test_files/richtext.docx index 4b744c9..c1ad67b 100644 Binary files a/tests/test_files/richtext.docx and b/tests/test_files/richtext.docx differ diff --git a/tests/test_files/richtext_and_if.docx b/tests/test_files/richtext_and_if.docx index 74c9ec8..ba23810 100644 Binary files a/tests/test_files/richtext_and_if.docx and b/tests/test_files/richtext_and_if.docx differ diff --git a/tests/test_files/subdoc.docx b/tests/test_files/subdoc.docx index 439cec8..9579b91 100644 Binary files a/tests/test_files/subdoc.docx and b/tests/test_files/subdoc.docx differ diff --git a/tests/test_files/template_error.docx b/tests/test_files/template_error.docx index 808c49a..0955b00 100644 Binary files a/tests/test_files/template_error.docx and b/tests/test_files/template_error.docx differ diff --git a/tests/test_files/vertical_merge.docx b/tests/test_files/vertical_merge.docx index ad93ba1..f361990 100644 Binary files a/tests/test_files/vertical_merge.docx and b/tests/test_files/vertical_merge.docx differ diff --git a/tests/test_files/vertical_merge_nested.docx b/tests/test_files/vertical_merge_nested.docx index 782def6..b280177 100644 Binary files a/tests/test_files/vertical_merge_nested.docx and b/tests/test_files/vertical_merge_nested.docx differ diff --git a/tests/test_files/word2016.docx b/tests/test_files/word2016.docx index 7898772..aee16e5 100644 Binary files a/tests/test_files/word2016.docx and b/tests/test_files/word2016.docx differ