Commit bcb774d1 authored by Yakubov, Sergey's avatar Yakubov, Sergey
Browse files

Merge branch 'dev' into 'main'

Sync with dev to apply security changes

See merge request !99
parents 7b5f711f 0b4a7e39
Loading
Loading
Loading
Loading
Loading
+14 −1
Original line number Diff line number Diff line
import copy
import html
import json
import logging
import math
@@ -63,6 +64,15 @@ def safe_loads(arg):
    return loaded


def escape_key_names(obj):
    if isinstance(obj, dict):
        return {html.escape(str(key)): escape_key_names(value) for key, value in obj.items()}
    elif isinstance(obj, list):
        return [escape_key_names(element) for element in obj]
    else:
        return obj


def safe_dumps(obj, **kwargs):
    """
    This is a wrapper around dumps that encodes Infinity and NaN values.  It's a
@@ -70,6 +80,10 @@ def safe_dumps(obj, **kwargs):
    json.dumps to blow up if it encounters Infinity/NaN, or Decimal values
    and we 'fix' it before re-encoding.
    """
    if kwargs.get("escape_key_names", False):
        obj = escape_key_names(obj)
        kwargs.pop('escape_key_names')

    try:
        dumped = json.dumps(obj, allow_nan=False, **kwargs)
    except (ValueError, TypeError):
@@ -79,7 +93,6 @@ def safe_dumps(obj, **kwargs):
        return dumped.replace("</", "<\\/")
    return dumped


def safe_dumps_formatted(obj):
    """Attempt to format an object for display.

+2 −2
Original line number Diff line number Diff line
@@ -60,8 +60,8 @@
        console.debug("Initializing javascript application:", "${js_app_entry_fn}");

        // js-app.mako
        var options = ${ h.dumps( options ) };
        var bootstrapped = ${ h.dumps( bootstrapped ) };
        var options = ${ h.dumps( options, escape_key_names=True ) };
        var bootstrapped = ${ h.dumps( bootstrapped, escape_key_names=True ) };

        config.set({
            options: options,