123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395 |
- from __future__ import annotations
- import collections.abc as cabc
- import string
- import typing as t
- try:
- from ._speedups import _escape_inner
- except ImportError:
- from ._native import _escape_inner
- if t.TYPE_CHECKING:
- import typing_extensions as te
- class _HasHTML(t.Protocol):
- def __html__(self, /) -> str: ...
- class _TPEscape(t.Protocol):
- def __call__(self, s: t.Any, /) -> Markup: ...
- def escape(s: t.Any, /) -> Markup:
- """Replace the characters ``&``, ``<``, ``>``, ``'``, and ``"`` in
- the string with HTML-safe sequences. Use this if you need to display
- text that might contain such characters in HTML.
- If the object has an ``__html__`` method, it is called and the
- return value is assumed to already be safe for HTML.
- :param s: An object to be converted to a string and escaped.
- :return: A :class:`Markup` string with the escaped text.
- """
- # If the object is already a plain string, skip __html__ check and string
- # conversion. This is the most common use case.
- # Use type(s) instead of s.__class__ because a proxy object may be reporting
- # the __class__ of the proxied value.
- if type(s) is str:
- return Markup(_escape_inner(s))
- if hasattr(s, "__html__"):
- return Markup(s.__html__())
- return Markup(_escape_inner(str(s)))
- def escape_silent(s: t.Any | None, /) -> Markup:
- """Like :func:`escape` but treats ``None`` as the empty string.
- Useful with optional values, as otherwise you get the string
- ``'None'`` when the value is ``None``.
- >>> escape(None)
- Markup('None')
- >>> escape_silent(None)
- Markup('')
- """
- if s is None:
- return Markup()
- return escape(s)
- def soft_str(s: t.Any, /) -> str:
- """Convert an object to a string if it isn't already. This preserves
- a :class:`Markup` string rather than converting it back to a basic
- string, so it will still be marked as safe and won't be escaped
- again.
- >>> value = escape("<User 1>")
- >>> value
- Markup('<User 1>')
- >>> escape(str(value))
- Markup('&lt;User 1&gt;')
- >>> escape(soft_str(value))
- Markup('<User 1>')
- """
- if not isinstance(s, str):
- return str(s)
- return s
- class Markup(str):
- """A string that is ready to be safely inserted into an HTML or XML
- document, either because it was escaped or because it was marked
- safe.
- Passing an object to the constructor converts it to text and wraps
- it to mark it safe without escaping. To escape the text, use the
- :meth:`escape` class method instead.
- >>> Markup("Hello, <em>World</em>!")
- Markup('Hello, <em>World</em>!')
- >>> Markup(42)
- Markup('42')
- >>> Markup.escape("Hello, <em>World</em>!")
- Markup('Hello <em>World</em>!')
- This implements the ``__html__()`` interface that some frameworks
- use. Passing an object that implements ``__html__()`` will wrap the
- output of that method, marking it safe.
- >>> class Foo:
- ... def __html__(self):
- ... return '<a href="/foo">foo</a>'
- ...
- >>> Markup(Foo())
- Markup('<a href="/foo">foo</a>')
- This is a subclass of :class:`str`. It has the same methods, but
- escapes their arguments and returns a ``Markup`` instance.
- >>> Markup("<em>%s</em>") % ("foo & bar",)
- Markup('<em>foo & bar</em>')
- >>> Markup("<em>Hello</em> ") + "<foo>"
- Markup('<em>Hello</em> <foo>')
- """
- __slots__ = ()
- def __new__(
- cls, object: t.Any = "", encoding: str | None = None, errors: str = "strict"
- ) -> te.Self:
- if hasattr(object, "__html__"):
- object = object.__html__()
- if encoding is None:
- return super().__new__(cls, object)
- return super().__new__(cls, object, encoding, errors)
- def __html__(self, /) -> te.Self:
- return self
- def __add__(self, value: str | _HasHTML, /) -> te.Self:
- if isinstance(value, str) or hasattr(value, "__html__"):
- return self.__class__(super().__add__(self.escape(value)))
- return NotImplemented
- def __radd__(self, value: str | _HasHTML, /) -> te.Self:
- if isinstance(value, str) or hasattr(value, "__html__"):
- return self.escape(value).__add__(self)
- return NotImplemented
- def __mul__(self, value: t.SupportsIndex, /) -> te.Self:
- return self.__class__(super().__mul__(value))
- def __rmul__(self, value: t.SupportsIndex, /) -> te.Self:
- return self.__class__(super().__mul__(value))
- def __mod__(self, value: t.Any, /) -> te.Self:
- if isinstance(value, tuple):
- # a tuple of arguments, each wrapped
- value = tuple(_MarkupEscapeHelper(x, self.escape) for x in value)
- elif hasattr(type(value), "__getitem__") and not isinstance(value, str):
- # a mapping of arguments, wrapped
- value = _MarkupEscapeHelper(value, self.escape)
- else:
- # a single argument, wrapped with the helper and a tuple
- value = (_MarkupEscapeHelper(value, self.escape),)
- return self.__class__(super().__mod__(value))
- def __repr__(self, /) -> str:
- return f"{self.__class__.__name__}({super().__repr__()})"
- def join(self, iterable: cabc.Iterable[str | _HasHTML], /) -> te.Self:
- return self.__class__(super().join(map(self.escape, iterable)))
- def split( # type: ignore[override]
- self, /, sep: str | None = None, maxsplit: t.SupportsIndex = -1
- ) -> list[te.Self]:
- return [self.__class__(v) for v in super().split(sep, maxsplit)]
- def rsplit( # type: ignore[override]
- self, /, sep: str | None = None, maxsplit: t.SupportsIndex = -1
- ) -> list[te.Self]:
- return [self.__class__(v) for v in super().rsplit(sep, maxsplit)]
- def splitlines( # type: ignore[override]
- self, /, keepends: bool = False
- ) -> list[te.Self]:
- return [self.__class__(v) for v in super().splitlines(keepends)]
- def unescape(self, /) -> str:
- """Convert escaped markup back into a text string. This replaces
- HTML entities with the characters they represent.
- >>> Markup("Main » <em>About</em>").unescape()
- 'Main » <em>About</em>'
- """
- from html import unescape
- return unescape(str(self))
- def striptags(self, /) -> str:
- """:meth:`unescape` the markup, remove tags, and normalize
- whitespace to single spaces.
- >>> Markup("Main »\t<em>About</em>").striptags()
- 'Main » About'
- """
- value = str(self)
- # Look for comments then tags separately. Otherwise, a comment that
- # contains a tag would end early, leaving some of the comment behind.
- # keep finding comment start marks
- while (start := value.find("<!--")) != -1:
- # find a comment end mark beyond the start, otherwise stop
- if (end := value.find("-->", start)) == -1:
- break
- value = f"{value[:start]}{value[end + 3:]}"
- # remove tags using the same method
- while (start := value.find("<")) != -1:
- if (end := value.find(">", start)) == -1:
- break
- value = f"{value[:start]}{value[end + 1:]}"
- # collapse spaces
- value = " ".join(value.split())
- return self.__class__(value).unescape()
- @classmethod
- def escape(cls, s: t.Any, /) -> te.Self:
- """Escape a string. Calls :func:`escape` and ensures that for
- subclasses the correct type is returned.
- """
- rv = escape(s)
- if rv.__class__ is not cls:
- return cls(rv)
- return rv # type: ignore[return-value]
- def __getitem__(self, key: t.SupportsIndex | slice, /) -> te.Self:
- return self.__class__(super().__getitem__(key))
- def capitalize(self, /) -> te.Self:
- return self.__class__(super().capitalize())
- def title(self, /) -> te.Self:
- return self.__class__(super().title())
- def lower(self, /) -> te.Self:
- return self.__class__(super().lower())
- def upper(self, /) -> te.Self:
- return self.__class__(super().upper())
- def replace(self, old: str, new: str, count: t.SupportsIndex = -1, /) -> te.Self:
- return self.__class__(super().replace(old, self.escape(new), count))
- def ljust(self, width: t.SupportsIndex, fillchar: str = " ", /) -> te.Self:
- return self.__class__(super().ljust(width, self.escape(fillchar)))
- def rjust(self, width: t.SupportsIndex, fillchar: str = " ", /) -> te.Self:
- return self.__class__(super().rjust(width, self.escape(fillchar)))
- def lstrip(self, chars: str | None = None, /) -> te.Self:
- return self.__class__(super().lstrip(chars))
- def rstrip(self, chars: str | None = None, /) -> te.Self:
- return self.__class__(super().rstrip(chars))
- def center(self, width: t.SupportsIndex, fillchar: str = " ", /) -> te.Self:
- return self.__class__(super().center(width, self.escape(fillchar)))
- def strip(self, chars: str | None = None, /) -> te.Self:
- return self.__class__(super().strip(chars))
- def translate(
- self,
- table: cabc.Mapping[int, str | int | None], # type: ignore[override]
- /,
- ) -> str:
- return self.__class__(super().translate(table))
- def expandtabs(self, /, tabsize: t.SupportsIndex = 8) -> te.Self:
- return self.__class__(super().expandtabs(tabsize))
- def swapcase(self, /) -> te.Self:
- return self.__class__(super().swapcase())
- def zfill(self, width: t.SupportsIndex, /) -> te.Self:
- return self.__class__(super().zfill(width))
- def casefold(self, /) -> te.Self:
- return self.__class__(super().casefold())
- def removeprefix(self, prefix: str, /) -> te.Self:
- return self.__class__(super().removeprefix(prefix))
- def removesuffix(self, suffix: str) -> te.Self:
- return self.__class__(super().removesuffix(suffix))
- def partition(self, sep: str, /) -> tuple[te.Self, te.Self, te.Self]:
- left, sep, right = super().partition(sep)
- cls = self.__class__
- return cls(left), cls(sep), cls(right)
- def rpartition(self, sep: str, /) -> tuple[te.Self, te.Self, te.Self]:
- left, sep, right = super().rpartition(sep)
- cls = self.__class__
- return cls(left), cls(sep), cls(right)
- def format(self, *args: t.Any, **kwargs: t.Any) -> te.Self:
- formatter = EscapeFormatter(self.escape)
- return self.__class__(formatter.vformat(self, args, kwargs))
- def format_map(
- self,
- mapping: cabc.Mapping[str, t.Any], # type: ignore[override]
- /,
- ) -> te.Self:
- formatter = EscapeFormatter(self.escape)
- return self.__class__(formatter.vformat(self, (), mapping))
- def __html_format__(self, format_spec: str, /) -> te.Self:
- if format_spec:
- raise ValueError("Unsupported format specification for Markup.")
- return self
- class EscapeFormatter(string.Formatter):
- __slots__ = ("escape",)
- def __init__(self, escape: _TPEscape) -> None:
- self.escape: _TPEscape = escape
- super().__init__()
- def format_field(self, value: t.Any, format_spec: str) -> str:
- if hasattr(value, "__html_format__"):
- rv = value.__html_format__(format_spec)
- elif hasattr(value, "__html__"):
- if format_spec:
- raise ValueError(
- f"Format specifier {format_spec} given, but {type(value)} does not"
- " define __html_format__. A class that defines __html__ must define"
- " __html_format__ to work with format specifiers."
- )
- rv = value.__html__()
- else:
- # We need to make sure the format spec is str here as
- # otherwise the wrong callback methods are invoked.
- rv = super().format_field(value, str(format_spec))
- return str(self.escape(rv))
- class _MarkupEscapeHelper:
- """Helper for :meth:`Markup.__mod__`."""
- __slots__ = ("obj", "escape")
- def __init__(self, obj: t.Any, escape: _TPEscape) -> None:
- self.obj: t.Any = obj
- self.escape: _TPEscape = escape
- def __getitem__(self, key: t.Any, /) -> te.Self:
- return self.__class__(self.obj[key], self.escape)
- def __str__(self, /) -> str:
- return str(self.escape(self.obj))
- def __repr__(self, /) -> str:
- return str(self.escape(repr(self.obj)))
- def __int__(self, /) -> int:
- return int(self.obj)
- def __float__(self, /) -> float:
- return float(self.obj)
- def __getattr__(name: str) -> t.Any:
- if name == "__version__":
- import importlib.metadata
- import warnings
- warnings.warn(
- "The '__version__' attribute is deprecated and will be removed in"
- " MarkupSafe 3.1. Use feature detection, or"
- ' `importlib.metadata.version("markupsafe")`, instead.',
- stacklevel=2,
- )
- return importlib.metadata.version("markupsafe")
- raise AttributeError(name)
|