[issue26585] Use html.escape to replace _quote_html in http.server

Xiang Zhang added the comment: Happy to see it works. Thanks for your reviews too. :) -- ___ Python tracker ___

[issue26585] Use html.escape to replace _quote_html in http.server

Martin Panter added the comment: Thanks for the patch Xiang -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker

[issue26585] Use html.escape to replace _quote_html in http.server

Roundup Robot added the comment: New changeset bf44913588b7 by Martin Panter in branch 'default': Issue #26585: Eliminate _quote_html() and use html.escape(quote=False) https://hg.python.org/cpython/rev/bf44913588b7 -- nosy: +python-dev ___ Python

[issue26585] Use html.escape to replace _quote_html in http.server

Martin Panter added the comment: I left a couple notes on minor style nits (which I can fix when I commit this). But perhaps we should fix the business with tempdir_name and absolute URL paths (Issue 26609) first. -- dependencies: +Wrong request target in test_httpservers.py

[issue26585] Use html.escape to replace _quote_html in http.server

Xiang Zhang added the comment: Thanks for the reviews. I have updated the patch. -- Added file: http://bugs.python.org/file42220/_quote_html_to_html_escape_v5.patch ___ Python tracker

[issue26585] Use html.escape to replace _quote_html in http.server

Xiang Zhang added the comment: make some change to test for html escape in SimpleHTTPRequestHandler -- Added file: http://bugs.python.org/file42205/_quote_html_to_html_escape_v3.patch ___ Python tracker

[issue26585] Use html.escape to replace _quote_html in http.server

Xiang Zhang added the comment: The uploaded patch is updated. Hope you have time to review. -- Added file: http://bugs.python.org/file42218/_quote_html_to_html_escape_v4.patch ___ Python tracker

[issue26585] Use html.escape to replace _quote_html in http.server

Xiang Zhang added the comment: At first I also want to use html.escape(..., quote=False) since the spec only asks to escape quote signs in attribute. But after some search on Google, there are articles recommends escaping quote in content too:

[issue26585] Use html.escape to replace _quote_html in http.server

Xiang Zhang added the comment: Oops. You have already left new comment. No notify either. :( I like the idea that extract the actual encoding from response header. I will update my patch then. -- ___ Python tracker

[issue26585] Use html.escape to replace _quote_html in http.server

Xiang Zhang added the comment: OK. You left the comment preferring using ascii or utf-8 to encode the filename in test. But actually the response SimpeHTTPRequestHandler send is explicitly encoded in filesystemdefaultencoding. So in such a case, am I doing right? --

[issue26585] Use html.escape to replace _quote_html in http.server

Xiang Zhang added the comment: It's BaseHTTPRequestHandler, not BaseHTTPServer. -- ___ Python tracker ___ ___

[issue26585] Use html.escape to replace _quote_html in http.server

Changes by Martin Panter : -- stage: -> patch review ___ Python tracker ___ ___

[issue26585] Use html.escape to replace _quote_html in http.server

New submission from Xiang Zhang: In http.server, _quote_html is used to escape content for BaseHTTPServer. The function has already been implemented by html.escape. -- components: Library (Lib) files: _quote_html_to_html_escape.patch keywords: patch messages: 261943 nosy: xiang.zhang

[issue26585] Use html.escape to replace _quote_html in http.server

Xiang Zhang added the comment: I add two tests for html escaping. One for the error message and the other for display name in SimpleHTTPRequesthandler. -- Added file: http://bugs.python.org/file42204/_quote_html_to_html_escape_v2.patch ___ Python

[issue26585] Use html.escape to replace _quote_html in http.server

Martin Panter added the comment: Yeah I would be happy if you want to change to html.escape(quote=False) in list_directory() as well. BTW I am getting Undelivered Mail replies from the review comments. I guess they might be getting rejected due to looking like spam (they tend to be

[issue26585] Use html.escape to replace _quote_html in http.server

Martin Panter added the comment: Removing the redundant _quote_html() function seems like a good idea to me. I wonder if the code should be using the html.escape(..., quote=False) option though, because it does not need to encode quote signs. It might be good to add a test. It looks like

[issue26585] Use html.escape to replace _quote_html in http.server

Xiang Zhang added the comment: Thanks for your review. Set quote to False when html.escape is OK to me. But except for the usage in BaseHTTPRequestHandler, I think we should also set quote to False for the usage in SimpleHTTPRequestHandler since they do not appear in attribute either. And I

[issue26585] Use html.escape to replace _quote_html in http.server

Martin Panter added the comment: Thanks for the tests. I left a couple comments. About encoding quotes: Personally I don’t see much value unless you are encoding an attribute value, in which case I would prefer to use xml.sax.saxutils.quoteattr(). Encoded quotes would only become useful if