from django import template
from django.core.urlresolvers import reverse, NoReverseMatch
from django.template.defaultfilters import stringfilter
from django.utils.safestring import mark_safe


from emoji import Emoji

register = template.Library()


@register.filter(name='emoji_replace', is_safe=True)
@stringfilter
def emoji_replace(value):
    return mark_safe(Emoji.replace(value))


@register.filter(name='emoji_replace_unicode', is_safe=True)
@stringfilter
def emoji_replace_unicode(value):
    return mark_safe(Emoji.replace_unicode(value))


@register.filter(name='emoji_replace_html_entities', is_safe=True)
@stringfilter
def emoji_replace_html_entities(value):
    return mark_safe(Emoji.replace_html_entities(value))


@register.simple_tag
def emoji_load():
    try:
        url = reverse('emoji:list.json')
    except NoReverseMatch:
        return ''
    else:
        return "Emoji.setDataUrl('{0}').load();".format(url)

from django import template
from django.core.urlresolvers import reverse, NoReverseMatch
from django.template.defaultfilters import stringfilter
from django.utils.safestring import mark_safe, SafeData
from django.utils.html import escape


from emoji import Emoji

register = template.Library()


@register.filter(name='emoji_replace', is_safe=True, needs_autoescape=True)
@stringfilter
def emoji_replace(value, autoescape=None):
    autoescape = autoescape and not isinstance(value, SafeData)
    if autoescape:
        value = escape(value)
    return mark_safe(Emoji.replace(value))


@register.filter(name='emoji_replace_unicode', is_safe=True, needs_autoescape=True)
@stringfilter
def emoji_replace_unicode(value, autoescape=None):
    autoescape = autoescape and not isinstance(value, SafeData)
    if autoescape:
        value = escape(value)
    return mark_safe(Emoji.replace_unicode(value))


@register.filter(name='emoji_replace_html_entities',
                 is_safe=True, needs_autoescape=True)
@stringfilter
def emoji_replace_html_entities(value, autoescape=None):
    autoescape = autoescape and not isinstance(value, SafeData)
    if autoescape:
        value = escape(value)
    return mark_safe(Emoji.replace_html_entities(value))


@register.simple_tag
def emoji_load():
    try:
        url = reverse('emoji:list.json')
    except NoReverseMatch:
        return ''
    else:
        return "Emoji.setDataUrl('{0}').load();".format(url)

Update the filters to escape the characters before replacing them.
Update the filters to escape the characters before replacing them.

This prevents the filters from allowing XSS attacks. This follows
the pattern used by django's linebreaksbr filter.

  from django import template
  from django.core.urlresolvers import reverse, NoReverseMatch
  from django.template.defaultfilters import stringfilter
- from django.utils.safestring import mark_safe
+ from django.utils.safestring import mark_safe, SafeData
+ from django.utils.html import escape
  
  
  from emoji import Emoji
  
  register = template.Library()
  
  
- @register.filter(name='emoji_replace', is_safe=True)
+ @register.filter(name='emoji_replace', is_safe=True, needs_autoescape=True)
  @stringfilter
- def emoji_replace(value):
+ def emoji_replace(value, autoescape=None):
+     autoescape = autoescape and not isinstance(value, SafeData)
+     if autoescape:
+         value = escape(value)
      return mark_safe(Emoji.replace(value))
  
  
- @register.filter(name='emoji_replace_unicode', is_safe=True)
+ @register.filter(name='emoji_replace_unicode', is_safe=True, needs_autoescape=True)
  @stringfilter
- def emoji_replace_unicode(value):
+ def emoji_replace_unicode(value, autoescape=None):
+     autoescape = autoescape and not isinstance(value, SafeData)
+     if autoescape:
+         value = escape(value)
      return mark_safe(Emoji.replace_unicode(value))
  
  
- @register.filter(name='emoji_replace_html_entities', is_safe=True)
+ @register.filter(name='emoji_replace_html_entities',
+                  is_safe=True, needs_autoescape=True)
  @stringfilter
- def emoji_replace_html_entities(value):
+ def emoji_replace_html_entities(value, autoescape=None):
+     autoescape = autoescape and not isinstance(value, SafeData)
+     if autoescape:
+         value = escape(value)
      return mark_safe(Emoji.replace_html_entities(value))
  
  
  @register.simple_tag
  def emoji_load():
      try:
          url = reverse('emoji:list.json')
      except NoReverseMatch:
          return ''
      else:
          return "Emoji.setDataUrl('{0}').load();".format(url)
  
Update the filters to escape the characters before replacing them.
## Code Before:
from django import template
from django.core.urlresolvers import reverse, NoReverseMatch
from django.template.defaultfilters import stringfilter
from django.utils.safestring import mark_safe


from emoji import Emoji

register = template.Library()


@register.filter(name='emoji_replace', is_safe=True)
@stringfilter
def emoji_replace(value):
    return mark_safe(Emoji.replace(value))


@register.filter(name='emoji_replace_unicode', is_safe=True)
@stringfilter
def emoji_replace_unicode(value):
    return mark_safe(Emoji.replace_unicode(value))


@register.filter(name='emoji_replace_html_entities', is_safe=True)
@stringfilter
def emoji_replace_html_entities(value):
    return mark_safe(Emoji.replace_html_entities(value))


@register.simple_tag
def emoji_load():
    try:
        url = reverse('emoji:list.json')
    except NoReverseMatch:
        return ''
    else:
        return "Emoji.setDataUrl('{0}').load();".format(url)

## Instruction:
Update the filters to escape the characters before replacing them.
## Code After:
from django import template
from django.core.urlresolvers import reverse, NoReverseMatch
from django.template.defaultfilters import stringfilter
from django.utils.safestring import mark_safe, SafeData
from django.utils.html import escape


from emoji import Emoji

register = template.Library()


@register.filter(name='emoji_replace', is_safe=True, needs_autoescape=True)
@stringfilter
def emoji_replace(value, autoescape=None):
    autoescape = autoescape and not isinstance(value, SafeData)
    if autoescape:
        value = escape(value)
    return mark_safe(Emoji.replace(value))


@register.filter(name='emoji_replace_unicode', is_safe=True, needs_autoescape=True)
@stringfilter
def emoji_replace_unicode(value, autoescape=None):
    autoescape = autoescape and not isinstance(value, SafeData)
    if autoescape:
        value = escape(value)
    return mark_safe(Emoji.replace_unicode(value))


@register.filter(name='emoji_replace_html_entities',
                 is_safe=True, needs_autoescape=True)
@stringfilter
def emoji_replace_html_entities(value, autoescape=None):
    autoescape = autoescape and not isinstance(value, SafeData)
    if autoescape:
        value = escape(value)
    return mark_safe(Emoji.replace_html_entities(value))


@register.simple_tag
def emoji_load():
    try:
        url = reverse('emoji:list.json')
    except NoReverseMatch:
        return ''
    else:
        return "Emoji.setDataUrl('{0}').load();".format(url)
