@@ -250,7 +250,9 @@ def do_items(value: t.Union[t.Mapping[K, V], Undefined]) -> t.Iterator[t.Tuple[K
250
250
yield from value .items ()
251
251
252
252
253
- _space_re = re .compile (r"\s" , flags = re .ASCII )
253
+ # Check for characters that would move the parser state from key to value.
254
+ # https://html.spec.whatwg.org/#attribute-name-state
255
+ _attr_key_re = re .compile (r"[\s/>=]" , flags = re .ASCII )
254
256
255
257
256
258
@pass_eval_context
@@ -259,8 +261,14 @@ def do_xmlattr(
259
261
) -> str :
260
262
"""Create an SGML/XML attribute string based on the items in a dict.
261
263
262
- If any key contains a space, this fails with a ``ValueError``. Values that
263
- are neither ``none`` nor ``undefined`` are automatically escaped.
264
+ **Values** that are neither ``none`` nor ``undefined`` are automatically
265
+ escaped, safely allowing untrusted user input.
266
+
267
+ User input should not be used as **keys** to this filter. If any key
268
+ contains a space, ``/`` solidus, ``>`` greater-than sign, or ``=`` equals
269
+ sign, this fails with a ``ValueError``. Regardless of this, user input
270
+ should never be used as keys to this filter, or must be separately validated
271
+ first.
264
272
265
273
.. sourcecode:: html+jinja
266
274
@@ -280,6 +288,10 @@ def do_xmlattr(
280
288
As you can see it automatically prepends a space in front of the item
281
289
if the filter returned something unless the second parameter is false.
282
290
291
+ .. versionchanged:: 3.1.4
292
+ Keys with ``/`` solidus, ``>`` greater-than sign, or ``=`` equals sign
293
+ are not allowed.
294
+
283
295
.. versionchanged:: 3.1.3
284
296
Keys with spaces are not allowed.
285
297
"""
@@ -289,8 +301,8 @@ def do_xmlattr(
289
301
if value is None or isinstance (value , Undefined ):
290
302
continue
291
303
292
- if _space_re .search (key ) is not None :
293
- raise ValueError (f"Spaces are not allowed in attributes: ' { key } ' " )
304
+ if _attr_key_re .search (key ) is not None :
305
+ raise ValueError (f"Invalid character in attribute name: { key !r } " )
294
306
295
307
items .append (f'{ escape (key )} ="{ escape (value )} "' )
296
308
0 commit comments