Django Template Variable Resolution and Method Calls

You've identified an important issue related to Django's template variable resolution. This behavior is actually documented in the context of a security vulnerability that was addressed in Django 4.0.1.

The Issue

The problem you're encountering is that when Django's template engine tries to resolve a variable like p.clear, it will:

1. First look for a dictionary key named "clear"
2. If not found, it will look for an attribute named "clear"
3. If the attribute is callable (like the clear() method on dictionaries), it will call it

This is why your test fails - when the template encounters a dictionary without a "clear" key, it calls the dictionary's clear() method, which empties the dictionary. This leads to inconsistent rendering results between the first and second render.

Security Implications

This behavior was identified as a security vulnerability (CVE-2021-45116) in the dictsort template filter, as mentioned in the Django 4.0.1 release notes. The vulnerability could potentially lead to information disclosure or unintended method calls when using the dictsort filter with crafted keys.

From the Django 4.0.1 release notes:

Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure or unintended method calls, if passed a suitably crafted key.

In order to avoid this possibility, dictsort now works with a restricted resolution logic, that will not call methods, nor allow indexing on dictionaries.

As a reminder, all untrusted user input should be validated before use.

Solutions

To address this issue in your code, you have several options:

1. Always include the key: Make sure all dictionaries in your context have the "clear" key, even if it's set to None or False.

PYTHONCopied
context = {
    'parts': [
        {
            'name': 'one',
            'color': 'red',
            'clear': False  # Explicitly set
        },
        # ...
    ]
}

2. Use a different key name: Avoid using names that match dictionary methods like "clear", "keys", "items", etc.

3. Use dot notation with caution: Be aware of this behavior when using dot notation in templates with dictionaries.

4. Use template filters: You can use the get template filter to safely access dictionary keys:

DJANGOCopied
{% if p|get:'clear' %}clear{% else %}not clear{% endif %}

Best Practices

As mentioned in the Django documentation:

All untrusted user input should be validated before use.

This applies to template context data as well. Be cautious when passing dictionaries to templates, especially if they might contain keys that match method names.

The behavior you're seeing is expected according to Django's template variable resolution logic, but it can lead to unexpected results if you're not aware of it.