Comment 9 for bug 1567673

Revision history for this message
Richard Jones (r1chardj0n3s) wrote : Re: Possible client side template injection in horizon

I think the only place that could suffer from the blanket replacement is heat templates, and "{$" and "$}" are not part of that syntax.

The only change I'd make to the above patch therefore is to move it out into horizon.utils.escape.monkeypatch_escape so that the bulk of the code wasn't in settings. It's not clear whether other code might import escape from the django.utils.html module (thus avoiding our ability to monkey-patch it) hence I have placed the code as early as possible in our application.