Serialize Django Data for JavaScript

Re:Serialize Django Data for JavaScript by traverseda on Tuesday September 06, 2022 @10:42AM (#32737731)

Uhh, don't use the "safe" filter on user data that you're embedding in javascript, as that introduces arbitrary code injection attacks.

As for the default representation not being flat like the author needed, you can use the "values_list" method on your queryset.

I worry that articles like this lead to "the blind leading the blind". The arbitrary js injection attack enabled by their first example is concerning, and really should be accompanied by a big disclaimer saying "don't mess around with this filter unless you actually know what you're doing".

[ Parent | on HN ]

Re:Serialize Django Data for JavaScript by brento on Wednesday September 07, 2022 @09:29AM (#32750299)

See my comment here: https://news.ycombinator.com/item?id=32750266

[ Parent | on HN ]

Re:Serialize Django Data for JavaScript by traverseda on Wednesday September 07, 2022 @11:12AM (#32751696)

Right, but in another comment you talk about serializing querysets, and I'd be surprised if you can guarantee that no other developer will ever put dangerous data in any of the rows in your queryset. That approach would be building a pretty dangerous foot gun.

Just the whole approach gets dangerously close to a big security issue, even if you do it "right".

[ Parent | on HN ]

Re:Serialize Django Data for JavaScript by brento on Thursday September 08, 2022 @08:46AM (#32764711)

This is valid. I'll add an update to the post people should use caution and think about security.

[ Parent | on HN ]