[Django] #32899: enhance JSONResponse safe=True kwarg docs
Django
-------------------------------------+-------------------------------------
Reporter: Thomas | Owner: Simon Willison
Grainger |
Type: | Status: assigned
Cleanup/optimization |
Component: | Version: 3.2
Documentation |
Severity: Normal | Keywords:
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
currently JSONResponse documents a `safe` kwarg
```
Data to be dumped into json. By default only ``dict`` objects
are allowed to be passed due to a security flaw before EcmaScript 5.
See
the ``safe`` parameter for more information.
```
EcmaScript 5 is mostly dead, but there are other advantages to only
sending dicts, see https://twitter.com/simonw/status/1410682522908856320
--
Ticket URL: <https://code.djangoproject.com/ticket/32899>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
-------------------------------------+-------------------------------------
Type: | Willison
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 3.2
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Old description:
> currently JSONResponse documents a `safe` kwarg
>
> ```
> Data to be dumped into json. By default only ``dict`` objects
> are allowed to be passed due to a security flaw before EcmaScript
> 5. See
> the ``safe`` parameter for more information.
> ```
>
> EcmaScript 5 is mostly dead, but there are other advantages to only
> sending dicts, see https://twitter.com/simonw/status/1410682522908856320
New description:
currently JSONResponse documents a `safe` kwarg
{{{
Data to be dumped into json. By default only ``dict`` objects
are allowed to be passed due to a security flaw before EcmaScript 5.
See
the ``safe`` parameter for more information.
}}}
EcmaScript 5 is mostly dead, but there are other advantages to only
sending dicts, see https://twitter.com/simonw/status/1410682522908856320
--
--
Ticket URL: <https://code.djangoproject.com/ticket/32899#comment:1>
Django
Reporter: Thomas Grainger | Owner: (none)
Type: Cleanup/optimization | Status: new
Component: Documentation | Version: 3.2
Severity: Normal | Resolution:
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by Mariusz Felisiak):
* owner: Simon Willison => (none)
* status: assigned => new
* stage: Unreviewed => Accepted
Comment:
Agreed, we can enhance this warning. Thomas, would you like to submit a
patch?
--
Ticket URL: <https://code.djangoproject.com/ticket/32899#comment:2>
Django
Reporter: Thomas Grainger | Owner: (none)
Type: Cleanup/optimization | Status: new
Component: Documentation | Version: 3.2
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by Mariusz Felisiak):
* cc: Simon Willison (added)
--
Ticket URL: <https://code.djangoproject.com/ticket/32899#comment:3>
Django
-------------------------------------+-------------------------------------
Type: | Ramezani
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 3.2
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
* owner: (none) => Hasan Ramezani
* status: new => assigned
* has_patch: 0 => 1
Comment:
I added a small sentence to mention that object response makes the
expansion of response simpler.
@Mariusz, I think is about the `safe=True kwarg docs` but you mentioned to
`enhance the warning`. which warning do you mean?
--
Ticket URL: <https://code.djangoproject.com/ticket/32899#comment:4>
Django
-------------------------------------+-------------------------------------
Type: | Ramezani
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 3.2
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
* needs_better_patch: 0 => 1
Comment:
You've added a note to the docstring, which is fine, but we should also
add a note to the [https://docs.djangoproject.com/en/3.2/ref/request-
response/#serializing-non-dictionary-objects warning] in the docs.
--
Ticket URL: <https://code.djangoproject.com/ticket/32899#comment:5>
Django
-------------------------------------+-------------------------------------
Type: | Ramezani
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 3.2
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
* needs_better_patch: 1 => 0
--
Ticket URL: <https://code.djangoproject.com/ticket/32899#comment:6>
Django
-------------------------------------+-------------------------------------
Type: | Ramezani
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 3.2
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Hasan Ramezani):
@Mariusz, I got some reviews on PR. Could you please clarify for me what
should I do? Thanks!
--
Ticket URL: <https://code.djangoproject.com/ticket/32899#comment:7>
Django
-------------------------------------+-------------------------------------
Type: | Ramezani
Cleanup/optimization | Status: assigned
Component: Documentation | Version: 3.2
Severity: Normal | Resolution:
| checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
* stage: Accepted => Ready for checkin
--
Ticket URL: <https://code.djangoproject.com/ticket/32899#comment:8>
Django
-------------------------------------+-------------------------------------
Type: | Ramezani
Component: Documentation | Version: 3.2
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Ready for
| checkin
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
* status: assigned => closed
* resolution: => fixed
Comment:
In [changeset:"f5669fd7b568cf8a3eda1e65c1c6fb583c7b177d" f5669fd]:
{{{
#!CommitTicketReference repository=""
revision="f5669fd7b568cf8a3eda1e65c1c6fb583c7b177d"
Fixed #32899 -- Added note about avoiding non-dict objects in JsonResponse
docs.
Co-authored-by: Mariusz Felisiak <felisiak...@gmail.com>
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/32899#comment:9>