From 22506b2c162b34c4c45f748cf11ede75824a40cd Mon Sep 17 00:00:00 2001 From: haileyajohnson Date: Mon, 16 Jun 2025 14:22:34 -0700 Subject: Fixed #36465, Refs #35816 -- Disallowed '+' and '-' characters in template variable names. Regression in 5183f7c287a9a5d61ca1103b55166cda52d9c647. Thank you to Jon Banafato and Baptiste Mispelon for the report. --- django/template/base.py | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'django') diff --git a/django/template/base.py b/django/template/base.py index 140f713add..121a47d638 100644 --- a/django/template/base.py +++ b/django/template/base.py @@ -852,6 +852,13 @@ class Variable: "Variables and attributes may " "not begin with underscores: '%s'" % var ) + # Disallow characters that are allowed in numbers but not in a + # variable name. + for c in ["+", "-"]: + if c in var: + raise TemplateSyntaxError( + "Invalid character ('%s') in variable name: '%s'" % (c, var) + ) self.lookups = tuple(var.split(VARIABLE_ATTRIBUTE_SEPARATOR)) def resolve(self, context): -- cgit v1.3