Commits

Mike Orr committed e56c961

Escape nl2hr() argument to prevent stray HTML from passing through.

Comments (0)

Files changed (2)

tests/test_converters.py

 def test_nl2br():
     eq_(u'A B<br />\nC D<br />\n<br />\nE F', nl2br("A B\nC D\r\n\r\nE F"))
 
+def test_nl2br2():
+    eq_(u'&lt;strike&gt;W&lt;/strike&gt;<br />\nThe W', nl2br("<strike>W</strike>\nThe W"))
+
+def test_nl2br3():
+    eq_(u'<strike>W</strike><br />\nThe W', nl2br(literal("<strike>W</strike>\nThe W")))
+
 def test_format_paragraphs1():
     eq_(u"<p>crazy\n cross\n platform linebreaks</p>", format_paragraphs("crazy\r\n cross\r platform linebreaks"))
 

webhelpers/html/converters.py

     if text is None:
         return literal("")
     text = _universal_newline_rx.sub("\n", text)
-    text = text.replace("\n", br)
+    text = HTML(text).replace("\n", br)
     return text
 
 def format_paragraphs(text, preserve_lines=False):
Tip: Filter by directory path e.g. /media app.js to search for public/media/app.js.
Tip: Use camelCasing e.g. ProjME to search for ProjectModifiedEvent.java.
Tip: Filter by extension type e.g. /repo .js to search for all .js files in the /repo directory.
Tip: Separate your search with spaces e.g. /ssh pom.xml to search for src/ssh/pom.xml.
Tip: Use ↑ and ↓ arrow keys to navigate and return to view the file.
Tip: You can also navigate files with Ctrl+j (next) and Ctrl+k (previous) and view the file with Ctrl+o.
Tip: You can also navigate files with Alt+j (next) and Alt+k (previous) and view the file with Alt+o.