Escape several fields in our template macros.

Django won't auto-escape these values, so we'll need to handle it ourselves.

regulations/templatetags/macros.py

@@ -1,16 +1,19 @@
 """Macros used to make a few common tasks in templates easier"""
 from django import template
+from django.utils.html import escape
 
 register = template.Library()
 
 
 @register.inclusion_tag('regulations/macros/external_link.html')
 def external_link(url, text, classes="", title=""):
-    return {"url": url, "text": text, "classes": classes, "title": title}
+    return {"url": escape(url), "text": escape(text),
+            "classes": escape(classes), "title": escape(title)}
 
 
 @register.inclusion_tag('regulations/macros/search_for.html')
 def search_for(terms, reg, version, text=None):
     if text is None:
         text = terms
-    return {"terms": terms, "reg": reg, "version": version, "text": text}
+    return {"terms": terms, "reg": reg, "version": version,
+            "text": escape(text)}

regulations/tests/templatetags_macros_tests.py

@@ -35,6 +35,15 @@ def test_external_link_classes_title():
     assert 'some here' in anchor.get('class')
 
 
+def test_external_link_is_escaped():
+    # LXML decodes the value for us, so let's look at the raw markup
+    text = ('{% load macros %}'
+            '{% external_link url="http://example.com/?param=1&other=value" '
+            'text="value" %}')
+    as_str = Template(text).render(Context({}))
+    assert 'http://example.com/?param=1&other=value' in as_str
+
+
 def test_search_for():
     """Macro should url-encode search terms."""
     anchor = _gen_link(