diff --git a/CHANGES.rst b/CHANGES.rst index f3b2fab0..cf47ec8d 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -63,6 +63,7 @@ Unreleased - The request context does route matching before opening the session. This could allow a session interface to change behavior based on ``request.endpoint``. :issue:`3776` +- Use Jinja's implementation of the ``|tojson`` filter. :issue:`3881` Version 1.1.2 diff --git a/docs/api.rst b/docs/api.rst index 2df286fa..e6862878 100644 --- a/docs/api.rst +++ b/docs/api.rst @@ -250,14 +250,15 @@ for easier customization. By default it handles some extra data types: - :class:`~markupsafe.Markup` (or any object with a ``__html__`` method) will call the ``__html__`` method to get a string. -:func:`~htmlsafe_dumps` is also available as the ``|tojson`` template -filter. The filter marks the output with ``|safe`` so it can be used -inside ``script`` tags. +Jinja's ``|tojson`` filter is configured to use Flask's :func:`dumps` +function. The filter marks the output with ``|safe`` automatically. Use +the filter to render data inside `` .. autofunction:: jsonify diff --git a/docs/patterns/jquery.rst b/docs/patterns/jquery.rst index b0c0287f..fafbdf18 100644 --- a/docs/patterns/jquery.rst +++ b/docs/patterns/jquery.rst @@ -60,27 +60,9 @@ like this: .. sourcecode:: html+jinja -The ``|safe`` is necessary in Flask before 0.10 so that Jinja does not -escape the JSON encoded string with HTML rules. Usually this would be -necessary, but we are inside a ``script`` block here where different rules -apply. - -.. admonition:: Information for Pros - - In HTML the ``script`` tag is declared ``CDATA`` which means that entities - will not be parsed. Everything until ```` is handled as script. - This also means that there must never be any ``"|tojson|safe }}`` is rendered as - ``"<\/script>"``). - - In Flask 0.10 it goes a step further and escapes all HTML tags with - unicode escapes. This makes it possible for Flask to automatically - mark the result as HTML safe. - JSON View Functions ------------------- diff --git a/docs/templating.rst b/docs/templating.rst index bf18426b..b0964df8 100644 --- a/docs/templating.rst +++ b/docs/templating.rst @@ -95,37 +95,6 @@ by default: {% from '_helpers.html' import my_macro with context %} -Standard Filters ----------------- - -Flask provides the following Jinja2 filters in addition to the filters provided -by Jinja2 itself: - -.. function:: tojson - :noindex: - - This function converts the given object into JSON representation. This - is for example very helpful if you try to generate JavaScript on the - fly. - - .. sourcecode:: html+jinja - - - - It is also safe to use the output of `|tojson` in a *single-quoted* HTML - attribute: - - .. sourcecode:: html+jinja - - - - Note that in versions of Flask prior to 0.10, if using the output of - ``|tojson`` inside ``script``, make sure to disable escaping with ``|safe``. - In Flask 0.10 and above, this happens automatically. Controlling Autoescaping ------------------------ diff --git a/src/flask/app.py b/src/flask/app.py index e58ee983..87058495 100644 --- a/src/flask/app.py +++ b/src/flask/app.py @@ -681,7 +681,7 @@ class Flask(Scaffold): session=session, g=g, ) - rv.filters["tojson"] = json.tojson_filter + rv.policies["json.dumps_function"] = json.dumps return rv def create_global_jinja_loader(self): diff --git a/src/flask/json/__init__.py b/src/flask/json/__init__.py index f6feeb23..6d7fe564 100644 --- a/src/flask/json/__init__.py +++ b/src/flask/json/__init__.py @@ -5,7 +5,7 @@ import warnings from datetime import date from datetime import datetime -from markupsafe import Markup +from jinja2.utils import htmlsafe_json_dumps as _jinja_htmlsafe_dumps from werkzeug.http import http_date from ..globals import current_app @@ -234,30 +234,28 @@ def load(fp, app=None, **kwargs): return _json.load(fp, **kwargs) -_htmlsafe_map = str.maketrans( - {"<": "\\u003c", ">": "\\u003e", "&": "\\u0026", "'": "\\u0027"} -) - - def htmlsafe_dumps(obj, **kwargs): - """Serialize an object to a string of JSON, replacing HTML-unsafe - characters with Unicode escapes. Otherwise behaves the same as - :func:`dumps`. + """Serialize an object to a string of JSON with :func:`dumps`, then + replace HTML-unsafe characters with Unicode escapes and mark the + result safe with :class:`~markupsafe.Markup`. - This is available in templates as the ``|tojson`` filter, which will - also mark the result with ``|safe``. + This is available in templates as the ``|tojson`` filter. The returned string is safe to render in HTML documents and ``") - assert rv == '"\\u003c/script\\u003e"' - rv = render('{{ ""|tojson }}') - assert rv == '"\\u003c/script\\u003e"' - rv = render('{{ "<\0/script>"|tojson }}') - assert rv == '"\\u003c\\u0000/script\\u003e"' - rv = render('{{ "