defunkt/pystache — comment on commit 75254d671adcf0cbc56a9c86cb831d6b5a7676dc
File:  line 0
By lambacck:

This pull request was submitted 8 months ago so some of my recollections about what I did are fuzzy and since I decided to use something more deterministic than mustache as the user visible template language, I don't have working code that depends on this to remind myself of what I am doing.

I am fine with assuming that the output of the render method is valid html works for me, but markupsafe.escape will turn the result into a markupsafe.Markup object (which is a subclass of unicode) so you really need to be all in or you are not.

I am not going to argue the relative evilness of `try: import .. except: pass` here, fundamentally you either need to accept that or have something more onerous somewhere else. If the docs say, "Uses MarkupSafe if available" that is probably sufficient. The other option is to require MarkupSafe. My understanding is that MarkupSafe is faster than cgi.escape.

As far as valid HTML is concerned, whether single quotes are escaped by default or not is irrelevant. It is probably a bug that quote=True is not set on cgi.escape since that prevents use in attributes.