The patch looks good from a security perspective, so +1.
A minor thing that should probably be addressed is to protect against the whitelist being None. In WhitelistedFormatter:__init__(), the set() function will fail if whitelist is None. This would require one to explicitly set the config to None instead of an empty list, but it's possible and we should protect against it. Here is the code I'm referring to:
The patch looks good from a security perspective, so +1.
A minor thing that should probably be addressed is to protect against the whitelist being None. In WhitelistedForm atter:_ _init__ (), the set() function will fail if whitelist is None. This would require one to explicitly set the config to None instead of an empty list, but it's possible and we should protect against it. Here is the code I'm referring to:
+class WhiteListedForm atter(object) :
+
+ def __init__(self, whitelist, data):
+ self._whitelist = set(whitelist)