[ZPT] RE:Re: [Zope] prevent quoting in tal:attributes

[Evan Simpson]

Jamie Heilman wrote:
> OK, I'll conceed the need for a keyword toggle (or some like device)
> for entity quoting in XML.
[snip]
> 
> Anyway, I think we can at least agree that quoting dynamic attributes
> by default is preferable over not.  Yes?  Which would still leave us
> with the bug Evan has been trying to squash, which interestingly
> enough I can't seem trigger.

> <img alt="&amp;" tal:attributes="alt request/alt|default" />

That's because it only affects entities *other* than those for '&<>"'. 
When this is parsed, the attributes dict for this tag contains {'alt': 
'&'}, which allows tal:attributes to correctly recreate the attribute. 
On the other hand, if we had 'alt="&euro;"', the dict would contain 
{'alt': '&euro;'}, and tal:attributes generates 'alt="&amp;euro;"'.

This can be partially addressed by keeping the original string literal 
value for each attribute, and using that for 'default'.  For now, I plan 
to back out my changes, and implement this.

I'm not sure what the proper general solution for this is.  We want to 
be able to combine strings that contain entity references with strings 
that contain unescaped '&<>"' characters.  The only solution I can think 
of is to operate entirely in escaped strings, which is tricky:

 >>> euro = AttrString('&euro;', escaped=1)
 >>> s2 = AttrString('My S&L account has >%s100') % euro
 >>> print s2 + ' in it.'
My S&amp;L account has &gt;&euro;100 in it.

This is tricky to implement in Python 2.2.x, since it doesn't handle 
overriding of __mod__ on a str subclass properly.

Cheers,

Evan @ 4-am