zopefoundation / Zope / 19366816773

82%

push

github

Upgrade to Chameleon 4.6.0. (#1252)

* Use Chameleon 4.6.0

* Fix parsing of untrusted Python expressions.

This was returning an ast.Expression() node.
In Chameleon 4.4.4 that was handled correctly when generating code
(https://github.com/malthe/chameleon/blob/4.4.4/src/chameleon/astutil.py#L295)

In Chameleon >=4.5.0, it now uses ast.unparse for generating code.
It does not explicitly handle Expression nodes,
so it falls back to a generic visitor that clears the code generated so far.
Then we got strange indentation errors while trying to run the template.

Expression is meant to be a top-level node and shouldn't be used here.
Returning the expression body also matches what the trusted PythonExpr
does (https://github.com/malthe/chameleon/blob/master/src/chameleon/tales.py#L235)

* - remove comments

* - add a couple smaller dependency updates

---------

Co-authored-by: David Glick <david@glicksoftware.com>
Co-authored-by: Jens Vagelpohl <jens@plyp.com>

3531 of 6002 branches covered (58.83%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

28106 of 32420 relevant lines covered (86.69%)

0.87 hits per line