'Make sure we escape HTML entities, lest we court XSS errors.'

def test_escaping(self):

    class MockForm(object, ):
        errors = True
        auto_id = 'id_'
        def __iter__(self):
            return iter(self.visible_fields())
        def visible_fields(self):
            return [{'errors': ['<"evil&ness-field">']}]
        def non_field_errors(self):
            return ['<"evil&ness-non-field">']
    source = '{%    from    "includes/error_list.html"    import    errorlist    %}{{    errorlist(form)    }}'
    context = {'form': MockForm()}
    html = self.engine.from_string(source).render(context)
    assert ('<"evil&ness' not in html)
    assert ('&lt;&#34;evil&amp;ness-field&#34;&gt;' in html)
    assert ('&lt;&#34;evil&amp;ness-non-field&#34;&gt;' in html)
