Mako template inheritance, defs and HTML escaping: working versions (tested 2026-10-16)

mako==1.4.3
pytest==9.1.1

from mako.lookup import TemplateLookup

TEMPLATES = {
    "base.html": """\
<!doctype html>
<html>
<head><title>${self.page_title()}</title></head>
<body>
${self.body()}
</body>
</html>
""",
    "page.html": """\
<%inherit file="base.html"/>
<%!
def shout(text):
    return text.upper() + "!"
%>
<%def name="page_title()">${title}</%def>
<%def name="tag(name)"><span class="tag">${name}</span></%def>
<h1>${title}</h1>
<p>${subtitle | trim}</p>
<ul>
% for item in items:
  <li>${item}</li>
% endfor
</ul>
<footer>${shout("bye")}</footer>
${self.tag("featured")}
""",
}


def build_lookup(**options):
    lookup = TemplateLookup(default_filters=["h"], **options)
    for uri, source in TEMPLATES.items():
        lookup.put_string(uri, source)
    return lookup


def render_page(title, subtitle, items):
    template = build_lookup().get_template("page.html")
    return template.render(title=title, subtitle=subtitle, items=items)

import pytest
from renderer import build_lookup, render_page


def test_inherits_base_and_renders_def():
    html = render_page("My <Page>", "  hello  ", ["a"])
    assert html.startswith("<!doctype html>")
    assert "<title>My &lt;Page&gt;</title>" in html
    assert "<h1>My &lt;Page&gt;</h1>" in html


def test_escapes_loop_items_by_default():
    html = render_page("t", "s", ["<script>alert(1)</script>", "ok"])
    assert "<li>&lt;script&gt;alert(1)&lt;/script&gt;</li>" in html
    assert "<script>" not in html


def test_inherited_body_is_not_double_escaped():
    html = render_page("t", "s", [])
    assert '<span class="tag">featured</span>' in html
    assert "&lt;span" not in html


def test_trim_and_custom_filter():
    html = render_page("t", "  spaced  ", [])
    assert "<p>spaced</p>" in html
    assert "<footer>BYE!</footer>" in html


def test_undefined_variable_raises():
    template = build_lookup().get_template("page.html")
    with pytest.raises(NameError):
        template.render(subtitle="s", items=[])

[pytest]
pythonpath = .