fix: replace mark_safe(f-string) with format_html to prevent XSS in admin#219
Open
fabiocaccamo with Copilot wants to merge 6 commits into
Open
fix: replace mark_safe(f-string) with format_html to prevent XSS in admin#219fabiocaccamo with Copilot wants to merge 6 commits into
fabiocaccamo with Copilot wants to merge 6 commits into
Conversation
…dmin display methods Agent-Logs-Url: https://github.com/fabiocaccamo/django-treenode/sessions/6152e0b0-d0e9-4bed-b726-23c8565a663d Co-authored-by: fabiocaccamo <1035294+fabiocaccamo@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
fabiocaccamo
April 17, 2026 14:34
View session
fabiocaccamo
marked this pull request as ready for review
April 17, 2026 14:39
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens TreeNodeModelAdmin’s admin list display rendering by replacing raw mark_safe(f"...") HTML construction with Django’s format_html() / format_html_join() so interpolated values are properly escaped and stored XSS risk is reduced.
Changes:
- Update accordion display HTML generation to use
format_html()for attribute/value escaping. - Refactor breadcrumbs display to use
format_html_join()instead of manual string concatenation. - Refactor indentation display to use
format_html()while keeping indentation markup safe.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Agent-Logs-Url: https://github.com/fabiocaccamo/django-treenode/sessions/6d814c1c-4ac9-4081-b6d3-501937c8f267 Co-authored-by: fabiocaccamo <1035294+fabiocaccamo@users.noreply.github.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #219 +/- ##
==========================================
+ Coverage 91.23% 91.63% +0.40%
==========================================
Files 11 11
Lines 707 705 -2
==========================================
+ Hits 645 646 +1
+ Misses 62 59 -3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
…overage Agent-Logs-Url: https://github.com/fabiocaccamo/django-treenode/sessions/04b527c1-d509-4eb4-9ba8-de4f86688748 Co-authored-by: fabiocaccamo <1035294+fabiocaccamo@users.noreply.github.com>
fabiocaccamo
approved these changes
Apr 17, 2026
… format) Agent-Logs-Url: https://github.com/fabiocaccamo/django-treenode/sessions/c8376361-c20b-4a39-9393-689ca90fe34a Co-authored-by: fabiocaccamo <1035294+fabiocaccamo@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
treenode/admin.py: replacemark_safe(f'...')withformat_html(...)for proper HTML escaping in all three display methods_get_treenode_field_display_with_accordion,_get_treenode_field_display_with_breadcrumbs, and_get_treenode_field_display_with_indentationto restore code coverage (15 new tests, all pass)tests/test_admin.py)