From: John Bampton Date: Mon, 23 Dec 2019 22:21:43 +0000 (+1000) Subject: Fix case of JavaScript, GitHub and CSS. X-Git-Tag: v6.1.0b1~33^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a74b1de21fa478dee525efe5fa7d4507347f51aa;p=thirdparty%2Ftornado.git Fix case of JavaScript, GitHub and CSS. --- diff --git a/docs/guide/security.rst b/docs/guide/security.rst index 0dedabc3e..b65cd3f37 100644 --- a/docs/guide/security.rst +++ b/docs/guide/security.rst @@ -279,7 +279,7 @@ all requests:: For ``PUT`` and ``DELETE`` requests (as well as ``POST`` requests that do not use form-encoded arguments), the XSRF token may also be passed via an HTTP header named ``X-XSRFToken``. The XSRF cookie is normally -set when ``xsrf_form_html`` is used, but in a pure-Javascript application +set when ``xsrf_form_html`` is used, but in a pure-JavaScript application that does not use any regular forms you may need to access ``self.xsrf_token`` manually (just reading the property is enough to set the cookie as a side effect). diff --git a/docs/guide/templates.rst b/docs/guide/templates.rst index 9230be23e..61ce753e6 100644 --- a/docs/guide/templates.rst +++ b/docs/guide/templates.rst @@ -132,7 +132,7 @@ instead of ``None``. Note that while Tornado's automatic escaping is helpful in avoiding XSS vulnerabilities, it is not sufficient in all cases. Expressions -that appear in certain locations, such as in Javascript or CSS, may need +that appear in certain locations, such as in JavaScript or CSS, may need additional escaping. Additionally, either care must be taken to always use double quotes and `.xhtml_escape` in HTML attributes that may contain untrusted content, or a separate escaping function must be used for diff --git a/tornado/escape.py b/tornado/escape.py index 8d2d6bc88..3cf7ff2e4 100644 --- a/tornado/escape.py +++ b/tornado/escape.py @@ -69,7 +69,7 @@ def json_encode(value: Any) -> str: # JSON permits but does not require forward slashes to be escaped. # This is useful when json data is emitted in a tags from prematurely terminating - # the javascript. Some json libraries do this escaping by default, + # the JavaScript. Some json libraries do this escaping by default, # although python's standard library does not, so we do it here. # http://stackoverflow.com/questions/1580647/json-why-are-forward-slashes-escaped return json.dumps(value).replace("