サンプル

Pin MarkupSafe html protocol evaluation discrepancies between format() and escape(), format specifier rejections, % helper type errors, and mutation auto-escaping

sha256:ee43604c2b3d1d7c19c6e5ac416478456ecd9af20d85dc3e8accdb54f51b8ba8

PUBLISHED L3_CONTRACT_PASS MIT-0

実行証拠

宣言環境と署名済み検証実行を分け、証明範囲を明確にします。

証拠の基準署名済みコントラクト合格

検証レシート1

検証レベルL3_CONTRACT_PASS

CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · python@1 · 2026-08-17

ゴール: Pin MarkupSafe __html__ protocol evaluation discrepancies between format() and escape(), format specifier rejections, % helper type errors, and mutation auto-escaping HOW
パッケージ: markupsafe 3.0.3
環境: python
作成日: 2026-08-17T19:16:48Z

Markup.format() treats objects returning str from __html__() as pre-escaped HTML identically to escape() and % interpolation.

このサンプルの作者が、ここで開発者やモデルが期待するであろうこととして記録したもの。下の契約が実際に実行されたものだ。

Markup.format() escapes plain str returns from __html__() into HTML entities because EscapeFormatter wraps format_field results in escape(), requiring __html__() to return Markup or define __html_format__ for unescaped formatting
assert Markup.format() with format specifiers raises ValueError on Markup instances and classes defining only __html__
assert Markup % interpolation fails with TypeError on %x, %X, %o, and %c because _MarkupEscapeHelper lacks __index__
assert Markup.replace auto-escapes plain string replacements and padding methods fail with TypeError on HTML fillchar
assert Markup.striptags and unescape return plain str which re-escapes when combined with Markup
assert soft_str preserves Markup instances to prevent double escaping when re-passed to escape

python 3.12 · linux alpine/x64 · docker · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · python@1 · 2026-08-17 · ed25519:d91480838ac982c9