Optional error/warning if autoescape isn't used

[GoogleCodeExporter]

Could you add a function to enable errors/warnings for templates that don't use 
autoescape?

Original issue reported on code.google.com by olafvdspek on 22 Jan 2011 at 2:19

[GoogleCodeExporter]

Hmm, an interesting idea.  However, I think this is best done as a 
pre-processing step -- you could use a simple grep command (under unix, it 
would be something like 'grep -L "pragma autoescape" *.tpl').  I think that's 
better than adding functions to the ctemplate API.

Original comment by [email protected] on 24 Jan 2011 at 11:50

• Changed state: WontFix
• Added labels: Type-Enhancement, Priority-Medium

[GoogleCodeExporter]

Let me mention safe-by-default/design again. ;)
Calling such a function once is simple. Once there, the check will always be 
done.
Manually calling grep is more work likely to be forgotten and some time.

Original comment by olafvdspek on 25 Jan 2011 at 9:17

[GoogleCodeExporter]

This is a fair point, but it's also true that it's easy to forget to call the 
function.  Presumably you'd make the grep/etc part of your build workflow (a 
make command or some such), so it would be just as easy to forget or remember 
one as the other.

One of the tenets of API design is be very cautious about putting something in 
the API that can successfully be done at another level.  That tenet applies 
here, I'd say.

Original comment by [email protected] on 1 Feb 2011 at 9:36

[GoogleCodeExporter]

> but it's also true that it's easy to forget to call the function.

You could enable the error or warning by default to combat that.

> Presumably you'd make the grep/etc part of your build workflow (a make 
command or some such), so it would be just as easy to forget or remember one as 
the other.

1. I don't have grep on my Windows system.
2. Templates can easily be modified after the build is done, for example, by an 
administrator, who doesn't even compile the source code.

> One of the tenets of API design is be very cautious about putting something 
in the API that can successfully be done at another level.

Another is to reduce code duplication as much as possible. You're saying that 
each project has to reinvent/duplicate the escaping check code.

Isn't your recommendation to use auto escaping?

Original comment by olafvdspek on 1 Feb 2011 at 9:43

[GoogleCodeExporter]

Please?

Original comment by olafvdspek on 4 Oct 2011 at 10:31

[GoogleCodeExporter]

I'm sorry, I'm not going to add this to ctemplate (of course, you're welcome to 
hack it into your own version yourself).  This is correctly done, by the people 
who care, outside of ctemplate proper.

Original comment by [email protected] on 4 Oct 2011 at 10:33

[GoogleCodeExporter]

Hacking is not an option. :p
How do I verify (without modifying ctemplate), that every template uses auto 
escaping?

Original comment by olafvdspek on 4 Oct 2011 at 11:04

[GoogleCodeExporter]

Just analyze the template files using the tool of your choice.  I don't know 
windows, so I don't know what that tool would be, but there must be something 
similar to grep (or maybe you could download a version of grep that runs on 
windows).

Original comment by [email protected] on 4 Oct 2011 at 11:12

[GoogleCodeExporter]

That'd be hacking again. And bad software engineering.
The solution should be simple and cross-platform.

Original comment by olafvdspek on 5 Oct 2011 at 11:02

[GoogleCodeExporter]

Original comment by olafvdspek on 12 Feb 2012 at 2:31

[GoogleCodeExporter]

Original comment by olafvdspek on 12 Feb 2012 at 2:32

• Changed state: New