Merge branch '2.9-maintenance'

CHANGES

@@ -41,6 +41,18 @@ Version 2.10
 .. _#685: https://github.com/pallets/jinja/pull/685
 .. _#692: https://github.com/pallets/jinja/pull/692
 
+Version 2.9.7
+-------------
+
+(bugfix release, in development)
+
+- ``tojson`` filter marks output as safe to match documented behavior.
+  (`#718`_)
+- Resolved a bug where getting debug locals for tracebacks could
+  modify template context.
+
+.. _#718: https://github.com/pallets/jinja/pull/718
+
 Version 2.9.6
 -------------
 (bugfix release, released on April 3rd 2017)

jinja2/debug.py

@@ -198,7 +198,7 @@ def translate_exception(exc_info, initial_skip=0):
 def get_jinja_locals(real_locals):
     ctx = real_locals.get('context')
     if ctx:
-        locals = ctx.get_all()
+        locals = ctx.get_all().copy()
     else:
         locals = {}
 

jinja2/utils.py

@@ -567,7 +567,7 @@ def htmlsafe_json_dumps(obj, dumper=None, **kwargs):
         .replace(u'>', u'\\u003e') \
         .replace(u'&', u'\\u0026') \
         .replace(u"'", u'\\u0027')
-    return rv
+    return Markup(rv)
 
 
 @implements_iterator

tests/test_filters.py

@@ -640,8 +640,9 @@ def __init__(self, id, name):
     def test_json_dump(self):
         env = Environment(autoescape=True)
         t = env.from_string('{{ x|tojson }}')
-        assert t.render(x={'foo': 'bar'}) == '{"foo": "bar"}'
-        assert t.render(x='"bar\'') == r'"\"bar\u0027"'
+        assert t.render(x={'foo': 'bar'}) == '{"foo": "bar"}'
+        assert t.render(x='"ba&r\'') == r'"\"ba\u0026r\u0027"'
+        assert t.render(x='<bar>') == r'"\u003cbar\u003e"'
 
         def my_dumps(value, **options):
             assert options == {'foo': 'bar'}