Should set blocks be safe by default?

Right now this testcase would fail:

    def test_set_block(self):
        env = Environment(extensions=['jinja2.ext.autoescape'],
                          autoescape=True)
        tmpl = env.from_string('{% set foo %}<br>{% endset %}{{ foo }}')
        assert tmpl.render() == '<br>'

>       assert tmpl.render() == '<br>'
E       assert '&lt;br&gt;' == '<br>'
E         - &lt;br&gt;
E         + <br>

The contents of a set block is very similar to a macro though, so I think this behavior is not what you’d expect. Especially since you easily get double escaping, as shown in an extended version of the testcase above:

    def test_set_block(self):
        env = Environment(extensions=['jinja2.ext.autoescape'],
                          autoescape=True)
        tmpl = env.from_string('{% set foo %}{{ bar }}<br>{% endset %}'
                               '{{ foo }}')
>       assert tmpl.render(bar='<hr>') == '&lt;hr&gt;<br>'
E       assert '&amp;lt;hr&amp;gt;&lt;br&gt;' == '&lt;hr&gt;<br>'
E         - &amp;lt;hr&amp;gt;&lt;br&gt;
E         + &lt;hr&gt;<br>

If I add the safe filter to my set block (added in #489) the testcase passes fine, but I think this is the most common use case and thus shouldn’t require a filter.

[aaugustin]

Thanks Armin!

[aaugustin]

I just hit this issue as well.

My workaround:

{% set foo %} ... {% endset %}
{% set foo = foo | safe %}{# workaround for https://github.com/pallets/jinja/issues/490 #}