add UPDATING.md

apache · Sep 15, 2021 · c7fbe85 · c7fbe85
1 parent d40afd4
commit c7fbe85
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 2 deletions.
diff --git a/UPDATING.md b/UPDATING.md
@@ -25,6 +25,9 @@ assists people when migrating to a new version.
 ## Next
 
 ### Breaking Changes
+
+- [16711](https://github.com/apache/incubator-superset/pull/16711): The `url_param` Jinja function will now by default escape the result. For instance, the value `O'Brien` will now be changed to `O''Brien`. To disable this behavior, call `url_param` with `escape_result` set to `False`: `url_param("my_key", "my default", escape_result=False)`.
+
 ### Potential Downtime
 ### Deprecations
 ### Other

diff --git a/tests/integration_tests/jinja_context_tests.py b/tests/integration_tests/jinja_context_tests.py
@@ -200,20 +200,36 @@ def test_url_param_form_data(self) -> None:
             cache = ExtraCache()
             self.assertEqual(cache.url_param("foo"), "bar")
 
-    def test_unsafe_url_param_quoted_form_data(self) -> None:
+    def test_url_param_escaped_form_data(self) -> None:
         with app.test_request_context(
             query_string={"form_data": json.dumps({"url_params": {"foo": "O'Brien"}})}
         ):
             cache = ExtraCache(dialect=dialect())
             self.assertEqual(cache.url_param("foo"), "O''Brien")
 
-    def test_unsafe_url_param_unquoted_form_data(self) -> None:
+    def test_url_param_escaped_default_form_data(self) -> None:
+        with app.test_request_context(
+            query_string={"form_data": json.dumps({"url_params": {"foo": "O'Brien"}})}
+        ):
+            cache = ExtraCache(dialect=dialect())
+            self.assertEqual(cache.url_param("bar", "O'Malley"), "O''Malley")
+
+    def test_url_param_unescaped_form_data(self) -> None:
         with app.test_request_context(
             query_string={"form_data": json.dumps({"url_params": {"foo": "O'Brien"}})}
         ):
             cache = ExtraCache(dialect=dialect())
             self.assertEqual(cache.url_param("foo", escape_result=False), "O'Brien")
 
+    def test_url_param_unescaped_default_form_data(self) -> None:
+        with app.test_request_context(
+            query_string={"form_data": json.dumps({"url_params": {"foo": "O'Brien"}})}
+        ):
+            cache = ExtraCache(dialect=dialect())
+            self.assertEqual(
+                cache.url_param("bar", "O'Malley", escape_result=False), "O'Malley"
+            )
+
     def test_safe_proxy_primitive(self) -> None:
         def func(input: Any) -> Any:
             return input