How to Correctly Escape Jinja Code on Template? - python

How to render jinja code on template?
For instance, I have a route that need to render jinja code on the given HTML template like this:
from app import app
from flask import render_template
from jinja2 import Template
#app.route('/View/Package')
def getView():
HtmlDesc="""
<div class="codehilite"><pre><span></span><span class="p">{{</span><span class="n">cookiecutter</span><span class="o">.</span><span class="n">repo_name</span><span class="p">}}</span><span class="o">/</span><span class="p">{{</span><span class="n">cookiecutter</span><span class="o">.</span><span class="n">repo_name</span><span class="p">}}</span><span class="o">/</span><span class="p">{{</span><span class="n">cookiecutter</span><span class="o">.</span><span class="n">repo_name</span><span class="p">}}</span><span class="o">.</span><span class="n">py</span>
</pre></div>
"""
return render_template('package.html', html=Template(HtmlDesc).render())
On the template, I tried to escape jinja code with {% raw %}..{% endraw %} and {% filter escape %} .. {% endfilter %} as documented here but it still does not work:
<h1>Project Description</h1>
<div class="project-description">
{% raw %}{% filter escape %}{{html|safe}}{% endfilter %}{% endraw %}
</div>
</div>
With exception:
TemplateSyntaxError: unexpected '<'
I know the error is at {{</span><span... and class="p">}}, value of HtmlDesc, therefore I am looking for a proper way to escape these kind of characters of jinja in order to render this jinja code on template correctly. Thanks.
Added
What I am trying to achieve is I want the html and jinja code of HtmlDesc to be interpreted and render properly on web browser. In my real application, the text above is not a fixed value as in above example snippet, it reads value from text file README which includes inside python package and converted into HTML code. The example text above it is read from python package cookiecutter.

Add a | safe to the end of whatever you want to display. It will render it out. Make it a string too.
Inside the template you seem to be missing the |safe in the {{ }} inside the Markup
Also you have to remove the Template() to make sure that the whole string is escaped

Related

Highlighting the inner code blocks in Django Template Engine with django-pygmentify

I'm using django-pygmentify package in order to highlight my code blocks in my Django templates. The thing is that this package only supports code blocks as input. I have a model field that keeps markdown data. This markdown content might contain code blocks. (using ``` symbol)
Now, how can I highlight its inner code blocks??
Imagine I have a field that only contains source code. Like:
print('Hey..!')
In that case, this one works properly.
{% load pygmentify_tags %}
...
{% pygmentify %}
{{post.code}}
{% endpygmentify %}
Imagine my field contains the following content.
## Hello
This is my first step working with Python.
```python
print('Hey..!')
‍```
In this case, how can I implement it?? I can render that whole markdown content with {{post.body|markdown|safe}}, but how can I highlight those code blocks?? I also want to give all those code blocks a class name .code-block for better styling. Should I create a custom template tag?
You may use html standard <code> tag like this:
{% load pygmentify_tags %}
...
{% pygmentify %}
<code>
{{post.code}}
</code>
{% endpygmentify %}
This will separate the code section and at the same time will apply pygmentify to it.

How to exclude a part of a Django template file from processing?

I have a Django template file that has a couple of enormous strings in it (images encoded in Base64). When I use the Django templating engine, it chokes and takes 5 minutes to render the template. Is there a way to exclude a part of a template, with something like:
{% ignore %}
<img src='....'>
{% endignore %}
Does this exist?
Use verbatim tag!
From django docs https://docs.djangoproject.com/en/dev/ref/templates/builtins/#verbatim
verbatim
Stops the template engine from rendering the contents of this block
tag.
A common use is to allow a JavaScript template layer that collides
with Django’s syntax. For example:
{% verbatim %}
{{if dying}}Still alive.{{/if}}
{% endverbatim %}

Python variable to java script variable in Tornado [duplicate]

I'm using Tornado Templates and one of my fields is a string that has HTML tags quoted in it, e.g.
<p>Solar power</p>
When I render it into the template, the tags are quoted verbatim instead of treated as tags.
{{ quoted_html }}
So it looks exactly as above with the p tag visible.
In other templating systems, {{ = foo}} renders foo verbatim, but {{html foo}} treats the tags as tags.
Is there the equivalent in Tornado Templates?
{% raw foo %}, in Tornado 2.0+.
If you do that with a lot of expressions in a template, you can add the {% autoescape None %} directive to the beginning of the template, after which {{ foo }} will not be escaped.

Flask html not rendered when using Jinja2 templating tag

I'm using the (awesome) Flask framework to build a website and I now have a problem with html not being rendered properly. I've got a line in my template with an if-else depending on whether the public variable is True:
{{ theInfo if public else '<span style="background-color: green;">this info is hidden</span>' }}
Unfortunately, this simply displays the html in the browser, instead of rendering it. Do I need to somehow let Jinja know that its html should be rendered?
All tips are welcome!
By default Jinja escapes the passed data. Therefore you need to explicitly tell Jinja that data is safe to use:
{{ theInfo if public else '<span style="background-color: green;">this info is hidden</span>' | safe }}
If you want to display different html based on a value you need to first send this value in your call to render_template
python
def view():
variablename = True
return flask.render_template('page.html', public=variablename)
To check this value you add an if statement inside curly brackets, see code below
html
{% if public %}
<p>Public is true!</p>
{% else %}
<span ..../>
{% endif %}
A good first step is to go through the tutorial by Miguel Grinberg. http://blog.miguelgrinberg.com/post/the-flask-mega-tutorial-part-i-hello-world

How to return raw html in a Flask app bypassing template transformations

I have just started building my first Flask app, which currently simply returns output of inspect for my objects inside table tags. The problem is that instead of the html I expect, a template engine messes layout up creating new tags (I guess it parses dict's curly brackets).
From your question I don't really understand, why and where this inspect is ran, but it is possible to escape output like this:
{{ object | e }}
Or you can escape things inside template by using 'foo' or {% raw %}:
{{ '{{' }}
{% raw %}
{% %}
{% endraw %}

Categories