[Django] #35738: Deprecate double-dot variable lookups

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Type:
| Cleanup/optimization
Status: new | Component: Template
| system
Version: dev | Severity: Normal
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Currently, a double-dot variable lookup, like `{{ book..title }}`, is
allowed in templates. It maps to a lookup of the empty string before the
next lookup of the named attribute.

Supporting double-dot lookups means that when written accidentally, the
user gets a silent failure, as for a missing variable, rather than a
syntax error. The empty string lookup is unlikely to be used
intentionally.

This behaviour is also inconsistent with Python and Jinja, which both
raise a syntax error.

Let’s deprecated `..` in Django templates, eventually turning it into a
syntax error. We should be able to start by adding the warning in
`Variable.__init__`:

{{{#!diff
--- django/template/base.py
+++ django/template/base.py
@@ -842,6 +842,8 @@ def __init__(self, var):
"not begin with underscores: '%s'" % var
)
self.lookups =
tuple(var.split(VARIABLE_ATTRIBUTE_SEPARATOR))
+ if "" in self.lookups:
+ warnings.warn(...)

def resolve(self, context):
"""Resolve this variable against a given context."""
}}}

The warning message should include the template file and line.

This ticket follows [https://forum.djangoproject.com/t/deprecate-in-
template-variable-lookups/34180 this forum discussion], where Carlton +1'd
me on the concept.
--
Ticket URL: <https://code.djangoproject.com/ticket/35738>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#35738: Deprecate double-dot variable lookups

--------------------------------------+------------------------------------
Reporter: Adam Johnson | Owner: (none)

Type: Cleanup/optimization | Status: new
Component: Template system | Version: dev

Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

--------------------------------------+------------------------------------
Changes (by Claude Paroz):

* stage: Unreviewed => Accepted

--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:1>

[Django]

#35738: Deprecate double-dot variable lookups

-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: Sanjeev
Type: | Holla S
Cleanup/optimization | Status: assigned

Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------
Changes (by Sanjeev Holla S):

* owner: (none) => Sanjeev Holla S
* status: new => assigned

Comment:

I understood the issue and made the changes as suggested. Also I am able
to show the template file and the line in the warning. I
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:2>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: Sanjeev
Type: | Holla S
Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Sanjeev Holla S):

* cc: Sanjeev Holla S (added)

--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:3>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: Sanjeev
Type: | Holla S
Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Adam Johnson):

Sanjeev, can you open a pull request? See the guide at:
https://docs.djangoproject.com/en/dev/internals/contributing/writing-code
/working-with-git/
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:4>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: Sanjeev
Type: | Holla S
Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Sanjeev Holla S):

Replying to [comment:4 Adam Johnson]:

> Sanjeev, can you open a pull request? See the guide at:
https://docs.djangoproject.com/en/dev/internals/contributing/writing-code
/working-with-git/

Yes I'll create the pull request, just a small doubt

When a double-dot variable lookup is used, a warning with
`RemovedInDjango60Warning` should be raised?
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:5>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: Sanjeev
Type: | Holla S
Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Sanjeev Holla S):

Also I noticed one more thing, that is, the warning message can be seen in
the console only once because Django caches templates after they are
compiled, so warnings are triggered only during the initial compilation.
So is there any work around for this or is this fine? (Anyways, In the
settings.py file, the caching can be disabled which make sures that the
warning messages are shown whenever the page with double-dot variable
lookup is used)
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:6>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: Sanjeev
Type: | Holla S
Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Adam Johnson):

> When a double-dot variable lookup is used, a warning with
RemovedInDjango60Warning should be raised?

No, target 6.1 for removal, using `RemovedInDjango61Warning`.

See: https://docs.djangoproject.com/en/dev/internals/release-process
/#internal-release-deprecation-policy

> Also I noticed one more thing, that is, the warning message can be seen
in the console only once because Django caches templates after they are
compiled, so warnings are triggered only during the initial compilation.
So is there any work around for this or is this fine?

This is fine, and I think desirable. We don’t want to spam production logs
where a dot-dot has been deployed.
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:7>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: Sanjeev
Type: | Holla S
Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Sanjeev Holla S):

I have created a pull request.
PR - [https://github.com/django/django/pull/18551]

This would require many more improvements and optimizations in the code
but I would want to know whether the approach that I have used to get the
template name and the line number in the warning is fine or not?
So provide your feedback
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:8>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: Sanjeev
Type: | Holla S
Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Sanjeev Holla S):

Btw, is there any standards on how we display the warning messages that
include the file name and the specific line that triggered the warning?
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:9>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: Sanjeev
Type: | Holla S
Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Natalia Bidart):

Hello Sanjeev!

The process of how to deprecate a feature are described in this link:
https://docs.djangoproject.com/en/5.1/internals/contributing/writing-code
/submitting-patches/#deprecating-a-feature

In there you'll find details on how the process should be done, what code
change should be there and what tests we require.
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:10>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: Sanjeev
Type: | Holla S
Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Sanjeev Holla S):

Replying to [comment:10 Natalia Bidart]:

> Hello Sanjeev!
>
> The process of how to deprecate a feature are described in this link:
https://docs.djangoproject.com/en/5.1/internals/contributing/writing-code
/submitting-patches/#deprecating-a-feature
>
> In there you'll find details on how the process should be done, what
code change should be there and what tests we require.

Hey!

Sure I'll look into it. Actually I have added the warning similar to how
its mentioned in the doc but since it was suggested to show the `template`
name and line number which triggered the warning in the warning message, I
have added that functionality as well, but not sure if that would be fine
to go ahead with. So please check my PR once and confirm. Meanwhile I'll
add the tests for these in the PR
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:11>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------

Reporter: Adam Johnson | Owner: David
Type: | Smith

Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Natalia Bidart):

* cc: David Smith (added)
* has_patch: 0 => 1
* needs_better_patch: 0 => 1
* owner: Sanjeev Holla S => David Smith

Comment:

Updating flags and owner per recent updates. Setting as patch needs
improvements since the test suite fails with:
{{{
2025-06-06T12:44:52.2074547Z
django.utils.deprecation.RemovedInDjango70Warning: Support double-dot
lookups '..' which maps to a lookup of the empty string is deprecated.
2025-06-06T12:44:52.2074799Z Template:
D:\a\django\django\django\contrib\auth\templates\auth\widgets\read_only_password_hash.html
2025-06-06T12:44:52.2074867Z Line: 4
2025-06-06T12:44:52.2074872Z
2025-06-06T12:44:52.2074985Z
----------------------------------------------------------------------
2025-06-06T12:44:52.2075066Z Ran 18153 tests in 228.830s
2025-06-06T12:44:52.2075071Z
2025-06-06T12:44:52.2075192Z FAILED (errors=24, skipped=1476, expected
failures=5)
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:12>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: David
Type: | Smith
Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Rudraksha Dwivedi):

Replying to [comment:12 Natalia Bidart]:

> Updating flags and owner per recent updates. Setting as patch needs
improvements since the test suite fails with:
> {{{
> 2025-06-06T12:44:52.2074547Z
django.utils.deprecation.RemovedInDjango70Warning: Support double-dot
lookups '..' which maps to a lookup of the empty string is deprecated.
> 2025-06-06T12:44:52.2074799Z Template:
D:\a\django\django\django\contrib\auth\templates\auth\widgets\read_only_password_hash.html
> 2025-06-06T12:44:52.2074867Z Line: 4
> 2025-06-06T12:44:52.2074872Z
> 2025-06-06T12:44:52.2074985Z
----------------------------------------------------------------------
> 2025-06-06T12:44:52.2075066Z Ran 18153 tests in 228.830s
> 2025-06-06T12:44:52.2075071Z
> 2025-06-06T12:44:52.2075192Z FAILED (errors=24, skipped=1476, expected
failures=5)
> }}}

hi Natalia!
I wanted to understand why the patch needs improvement is set
the patch does seem to work
specifically, when i checkout on that branch; the tests have a diff. error
log when entire test suite is run

I think the patch provided by David has fixed the issue aptly
can you articulate if more work is needed? (if yes i'd like to work on
it!)

running the : tests/template_tests/syntax_tests/test_basic.py
results in no "Warnings" (as in python warning) are visible
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:13>

[Django]

#35738: Deprecate double-dot variable lookups
-------------------------------------+-------------------------------------
Reporter: Adam Johnson | Owner: David
Type: | Smith
Cleanup/optimization | Status: assigned
Component: Template system | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Natalia Bidart):

Replying to [comment:13 Rudraksha Dwivedi]:

> I wanted to understand why the patch needs improvement is set
> the patch does seem to work
> specifically, when i checkout on that branch; the tests have a diff.
error log when entire test suite is run

At the time of review, running the test suite on the branch raise the
warnings shown in my comment. Now, the branch has conflicts with `main`
which should be addressed before trying another test run.

I hope that helps!
--
Ticket URL: <https://code.djangoproject.com/ticket/35738#comment:14>