Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Products.PageTemplates (with chameleon): improper handling of (some) syntax errors #710

Open
d-maurer opened this issue Oct 4, 2019 · 8 comments
Open

Products.PageTemplates (with chameleon): improper handling of (some) syntax errors #710

d-maurer opened this issue Oct 4, 2019 · 8 comments
Labels
bug

Comments

@d-maurer
Copy link
Contributor

d-maurer commented Oct 4, 2019 •
edited
Loading

Some syntax errors are badly handled as the following transscript demonstrates:

>>> # ensure we use the `chameleon` template engine
>>> from zope.component import provideUtility
>>> from Products.PageTemplates.engine import Program
>>> provideUtility(Program)
>>> 
>>> from Products.PageTemplates.PageTemplate import PageTemplate
>>> pt = PageTemplate()
>>> pt.pt_edit(r'''
... <html><body>
... <div \
...    >
...    div with syntax error in start tag
...    <div>nested div</div>
... </div>
... </body></html>''',
... "text/html"
... )
>>> pt()
Traceback (most recent call last):
...
  File ...zope/pagetemplate/pagetemplate.py", line 129, in pt_render
    raise PTRuntimeError(str(self._v_errors))
zope.pagetemplate.pagetemplate.PTRuntimeError: ['Compilation failed', 'chameleon.exc.ParseError: Unexpected end tag.\n\n - String:     "</div>"\n - Filename:   <string>\n - Location:   (line 7: col 0)']

The trailing \ in the start tag of the outer div is clearly a syntax error. However, it is not flagged out as such. Instead the malformed start tag is silently ignored causing an error when the corresponding end tag is eventually reached. In more complex examples, the error may be reported even later which can make the analysis of the problem very expensive.

An initial analysis revealed: the syntax error is properly recognized by the "chameleon" parser. It tries to report it by calling a "visit" function with category "error". This tries to look up visit_error and finds it undefined. Therefore, it uses a default handling which ignores the tag.
@d-maurer d-maurer added the bug label Oct 4, 2019
@icemac
Copy link
Member

icemac commented Oct 11, 2019

@d-maurer Should this be fixed here in the Zope package or in zope.pagetemplate as the traceback seems to point to?

@d-maurer
Copy link
Contributor Author

d-maurer commented Oct 11, 2019 via email

@d-maurer
Copy link
Contributor Author

The error is actually in chameleon: chameleon.zpt.program.MacroProgram lacks a visit_error method.

Searching github (a few minutes ago) for chameleon caused Whao, you have triggered an abuse handling; try again later.

A few days ago, I hit another chameleon issue. My template contained:

<!--
...
<... tal:repeat="lv ..." ...>...<... tal:content="lv" .../>...</...>
-->

and rendering gave a NameError lv. Apparently, the tal:repeat was not executed but the tal:content was. I have not yet further analysed the issue (but simply removed the comment).

@d-maurer d-maurer mentioned this issue Oct 22, 2019
Open
@d-maurer
Copy link
Contributor Author

The error is actually in chameleon: chameleon.zpt.program.MacroProgram lacks a visit_error method.

The primary error is actually a missing visit_error in chameleon.parser.ElementParser.

@dataflake
Copy link
Member

Dieter, was this fixed as part of Chameleon 3.7.0?

@d-maurer
Copy link
Contributor Author

d-maurer commented Mar 31, 2020 via email

@dataflake
Copy link
Member

FYI, this is still unfixed with Chameleon 3.8.1

@d-maurer
Copy link
Contributor Author

The bug is not yet fixed in Chameleon = 4.2.0 (used by Zope 5.9.x).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@icemac @dataflake @d-maurer