api docs: Escape HTML in the examples.

Having HTML (or HTML-like) content in the examples was making parts of
the content invisible, since the browser identified them as HTML tags
rather than verbose text.
This commit is contained in:
Yago González 2018-08-14 02:50:05 +02:00 committed by Tim Abbott
parent c70d051031
commit df7234f3a6
1 changed files with 2 additions and 1 deletions

View File

@ -2,6 +2,7 @@ import re
import os
import ujson
from django.utils.html import escape as escape_html
from markdown.extensions import Extension
from markdown.preprocessors import Preprocessor
from zerver.lib.openapi import get_openapi_parameters
@ -133,7 +134,7 @@ class APIArgumentsTablePreprocessor(Preprocessor):
argument=argument.get('argument') or argument.get('name'),
# Show this as JSON to avoid changing the quoting style, which
# may cause problems with JSON encoding.
example=ujson.dumps(argument['example']),
example=escape_html(ujson.dumps(argument['example'])),
required='Yes' if argument.get('required') else 'No',
description=md_engine.convert(description),
))