See quoted "{{ variables }}" in a template that’s generating JSON? You’re probably seeing a security hole
There may be no code smell ranker than this:
That screenshot was sent by a 3rd-party form vendor who was getting frequent errors from their Marketo API calls and couldn’t figure out what was wrong.
“Does this look right?” they asked. “Nope,” I said immediately — even before they showed me any error messages.
See, even taking Marketo out of the picture, this is wrong for any API. If you see something like this, it’s frankly not suitable for work.
No way is that value correctly JSON-encoded
It’s clear they’re not encoding since there are double quotes outside the template variable. A JSON-encoded string always includes the double quotes. (Simple JavaScript example: JSON.stringify("Hello") is "Hello" with the quotes, not Hello. You cannot add another pair of " around it.)
Let’s review how their “bizarro JSON” logic works.
They’re using Jinja templates, but any template language works the same way. Since there’s no filter specified, the property
