Fixed #24464 -- Made built-in HTML template filter functions escape their input by default.

This may cause some backwards compatibility issues, but may also
resolve security issues in third party projects that fail to heed warnings
in our documentation.

Thanks Markus Holtermann for help with tests and docs.

7 files changed, 128 insertions, 9 deletions

diff --git a/tests/template_tests/filter_tests/test_join.py b/tests/template_tests/filter_tests/test_join.py
index 1a5193824b..12d2f7257e 100644
--- a/tests/template_tests/filter_tests/test_join.py
+++ b/tests/template_tests/filter_tests/test_join.py
@@ -54,3 +54,15 @@ class FunctionTests(SimpleTestCase):
 
     def test_list(self):
         self.assertEqual(join([0, 1, 2], 'glue'), '0glue1glue2')
+
+    def test_autoescape(self):
+        self.assertEqual(
+            join(['<a>', '<img>', '</a>'], '<br>'),
+            '&lt;a&gt;&lt;br&gt;&lt;img&gt;&lt;br&gt;&lt;/a&gt;',
+        )
+
+    def test_autoescape_off(self):
+        self.assertEqual(
+            join(['<a>', '<img>', '</a>'], '<br>', autoescape=False),
+            '<a>&lt;br&gt;<img>&lt;br&gt;</a>',
+        )
diff --git a/tests/template_tests/filter_tests/test_linebreaks.py b/tests/template_tests/filter_tests/test_linebreaks.py
index 041bfb7617..d895a067bb 100644
--- a/tests/template_tests/filter_tests/test_linebreaks.py
+++ b/tests/template_tests/filter_tests/test_linebreaks.py
@@ -39,3 +39,15 @@ class FunctionTests(SimpleTestCase):
 
     def test_non_string_input(self):
         self.assertEqual(linebreaks_filter(123), '<p>123</p>')
+
+    def test_autoescape(self):
+        self.assertEqual(
+            linebreaks_filter('foo\n<a>bar</a>\nbuz'),
+            '<p>foo<br />&lt;a&gt;bar&lt;/a&gt;<br />buz</p>',
+        )
+
+    def test_autoescape_off(self):
+        self.assertEqual(
+            linebreaks_filter('foo\n<a>bar</a>\nbuz', autoescape=False),
+            '<p>foo<br /><a>bar</a><br />buz</p>',
+        )
diff --git a/tests/template_tests/filter_tests/test_linebreaksbr.py b/tests/template_tests/filter_tests/test_linebreaksbr.py
index 0564402fa8..c702ba777f 100644
--- a/tests/template_tests/filter_tests/test_linebreaksbr.py
+++ b/tests/template_tests/filter_tests/test_linebreaksbr.py
@@ -36,3 +36,15 @@ class FunctionTests(SimpleTestCase):
 
     def test_non_string_input(self):
         self.assertEqual(linebreaksbr(123), '123')
+
+    def test_autoescape(self):
+        self.assertEqual(
+            linebreaksbr('foo\n<a>bar</a>\nbuz'),
+            'foo<br />&lt;a&gt;bar&lt;/a&gt;<br />buz',
+        )
+
+    def test_autoescape_off(self):
+        self.assertEqual(
+            linebreaksbr('foo\n<a>bar</a>\nbuz', autoescape=False),
+            'foo<br /><a>bar</a><br />buz',
+        )
diff --git a/tests/template_tests/filter_tests/test_linenumbers.py b/tests/template_tests/filter_tests/test_linenumbers.py
index d8c18b84d5..36ec8de0d5 100644
--- a/tests/template_tests/filter_tests/test_linenumbers.py
+++ b/tests/template_tests/filter_tests/test_linenumbers.py
@@ -44,3 +44,15 @@ class FunctionTests(SimpleTestCase):
 
     def test_non_string_input(self):
         self.assertEqual(linenumbers(123), '1. 123')
+
+    def test_autoescape(self):
+        self.assertEqual(
+            linenumbers('foo\n<a>bar</a>\nbuz'),
+            '1. foo\n2. &lt;a&gt;bar&lt;/a&gt;\n3. buz',
+        )
+
+    def test_autoescape_off(self):
+        self.assertEqual(
+            linenumbers('foo\n<a>bar</a>\nbuz', autoescape=False),
+            '1. foo\n2. <a>bar</a>\n3. buz'
+        )
diff --git a/tests/template_tests/filter_tests/test_unordered_list.py b/tests/template_tests/filter_tests/test_unordered_list.py
index 59d677b59a..815d488347 100644
--- a/tests/template_tests/filter_tests/test_unordered_list.py
+++ b/tests/template_tests/filter_tests/test_unordered_list.py
@@ -99,6 +99,18 @@ class FunctionTests(SimpleTestCase):
             '\n\t\t<li>Illinois</li>\n\t</ul>\n\t</li>',
         )
 
+    def test_autoescape(self):
+        self.assertEqual(
+            unordered_list(['<a>item 1</a>', 'item 2']),
+            '\t<li>&lt;a&gt;item 1&lt;/a&gt;</li>\n\t<li>item 2</li>',
+        )
+
+    def test_autoescape_off(self):
+        self.assertEqual(
+            unordered_list(['<a>item 1</a>', 'item 2'], autoescape=False),
+            '\t<li><a>item 1</a></li>\n\t<li>item 2</li>',
+        )
+
     def test_ulitem(self):
         @python_2_unicode_compatible
         class ULItem(object):
@@ -110,13 +122,48 @@ class FunctionTests(SimpleTestCase):
 
         a = ULItem('a')
         b = ULItem('b')
-        self.assertEqual(unordered_list([a, b]), '\t<li>ulitem-a</li>\n\t<li>ulitem-b</li>')
+        c = ULItem('<a>c</a>')
+        self.assertEqual(
+            unordered_list([a, b, c]),
+            '\t<li>ulitem-a</li>\n\t<li>ulitem-b</li>\n\t<li>ulitem-&lt;a&gt;c&lt;/a&gt;</li>',
+        )
+
+        def item_generator():
+            yield a
+            yield b
+            yield c
+
+        self.assertEqual(
+            unordered_list(item_generator()),
+            '\t<li>ulitem-a</li>\n\t<li>ulitem-b</li>\n\t<li>ulitem-&lt;a&gt;c&lt;/a&gt;</li>',
+        )
+
+    def test_ulitem_autoescape_off(self):
+        @python_2_unicode_compatible
+        class ULItem(object):
+            def __init__(self, title):
+                self.title = title
+
+            def __str__(self):
+                return 'ulitem-%s' % str(self.title)
+
+        a = ULItem('a')
+        b = ULItem('b')
+        c = ULItem('<a>c</a>')
+        self.assertEqual(
+            unordered_list([a, b, c], autoescape=False),
+            '\t<li>ulitem-a</li>\n\t<li>ulitem-b</li>\n\t<li>ulitem-<a>c</a></li>',
+        )
 
         def item_generator():
             yield a
             yield b
+            yield c
 
-        self.assertEqual(unordered_list(item_generator()), '\t<li>ulitem-a</li>\n\t<li>ulitem-b</li>')
+        self.assertEqual(
+            unordered_list(item_generator(), autoescape=False),
+            '\t<li>ulitem-a</li>\n\t<li>ulitem-b</li>\n\t<li>ulitem-<a>c</a></li>',
+        )
 
     @ignore_warnings(category=RemovedInDjango20Warning)
     def test_legacy(self):
diff --git a/tests/template_tests/filter_tests/test_urlize.py b/tests/template_tests/filter_tests/test_urlize.py
index 1c55d64751..ee6744e6cb 100644
--- a/tests/template_tests/filter_tests/test_urlize.py
+++ b/tests/template_tests/filter_tests/test_urlize.py
@@ -259,27 +259,27 @@ class FunctionTests(SimpleTestCase):
         #20364 - Check urlize correctly include quotation marks in links
         """
         self.assertEqual(
-            urlize('before "hi@example.com" afterwards'),
+            urlize('before "hi@example.com" afterwards', autoescape=False),
             'before "<a href="mailto:hi@example.com">hi@example.com</a>" afterwards',
         )
         self.assertEqual(
-            urlize('before hi@example.com" afterwards'),
+            urlize('before hi@example.com" afterwards', autoescape=False),
             'before <a href="mailto:hi@example.com">hi@example.com</a>" afterwards',
         )
         self.assertEqual(
-            urlize('before "hi@example.com afterwards'),
+            urlize('before "hi@example.com afterwards', autoescape=False),
             'before "<a href="mailto:hi@example.com">hi@example.com</a> afterwards',
         )
         self.assertEqual(
-            urlize('before \'hi@example.com\' afterwards'),
+            urlize('before \'hi@example.com\' afterwards', autoescape=False),
             'before \'<a href="mailto:hi@example.com">hi@example.com</a>\' afterwards',
         )
         self.assertEqual(
-            urlize('before hi@example.com\' afterwards'),
+            urlize('before hi@example.com\' afterwards', autoescape=False),
             'before <a href="mailto:hi@example.com">hi@example.com</a>\' afterwards',
         )
         self.assertEqual(
-            urlize('before \'hi@example.com afterwards'),
+            urlize('before \'hi@example.com afterwards', autoescape=False),
             'before \'<a href="mailto:hi@example.com">hi@example.com</a> afterwards',
         )
 
@@ -288,7 +288,7 @@ class FunctionTests(SimpleTestCase):
         #20364 - Check urlize copes with commas following URLs in quotes
         """
         self.assertEqual(
-            urlize('Email us at "hi@example.com", or phone us at +xx.yy'),
+            urlize('Email us at "hi@example.com", or phone us at +xx.yy', autoescape=False),
             'Email us at "<a href="mailto:hi@example.com">hi@example.com</a>", or phone us at +xx.yy',
         )
 
@@ -316,3 +316,15 @@ class FunctionTests(SimpleTestCase):
 
     def test_non_string_input(self):
         self.assertEqual(urlize(123), '123')
+
+    def test_autoescape(self):
+        self.assertEqual(
+            urlize('foo<a href=" google.com ">bar</a>buz'),
+            'foo&lt;a href=&quot; <a href="http://google.com" rel="nofollow">google.com</a> &quot;&gt;bar&lt;/a&gt;buz',
+        )
+
+    def test_autoescape_off(self):
+        self.assertEqual(
+            urlize('foo<a href=" google.com ">bar</a>buz', autoescape=False),
+            'foo<a href=" <a href="http://google.com" rel="nofollow">google.com</a> ">bar</a>buz',
+        )
diff --git a/tests/template_tests/filter_tests/test_urlizetrunc.py b/tests/template_tests/filter_tests/test_urlizetrunc.py
index 9530128369..2b4b18e1f5 100644
--- a/tests/template_tests/filter_tests/test_urlizetrunc.py
+++ b/tests/template_tests/filter_tests/test_urlizetrunc.py
@@ -78,3 +78,15 @@ class FunctionTests(SimpleTestCase):
 
     def test_non_string_input(self):
         self.assertEqual(urlizetrunc(123, 1), '123')
+
+    def test_autoescape(self):
+        self.assertEqual(
+            urlizetrunc('foo<a href=" google.com ">bar</a>buz', 10),
+            'foo&lt;a href=&quot; <a href="http://google.com" rel="nofollow">google.com</a> &quot;&gt;bar&lt;/a&gt;buz',
+        )
+
+    def test_autoescape_off(self):
+        self.assertEqual(
+            urlizetrunc('foo<a href=" google.com ">bar</a>buz', 9, autoescape=False),
+            'foo<a href=" <a href="http://google.com" rel="nofollow">google...</a> ">bar</a>buz',
+        )