[3.49.15] drf browser showing html tags for url-like fields

[jctanner]

Version

    "galaxy_ng_version": "4.10.0dev",
    "galaxy_ng_commit": "",
    "galaxy_importer_version": "0.4.24",
    "pulp_core_version": "3.49.15",
    "pulp_ansible_version": "0.21.7",
    "pulp_container_version": "2.19.3",
    "ansible_base_version": "1.0.0",

Describe the bug
In the DRF browseable rest api fields with values that resemble urls or email addresses are being rendered as html "a" tags.

"CONTENT_ORIGIN": "<a href="https://dev-aap.gcp.testing.ansible.com:443" rel="nofollow">https://dev-aap.gcp.testing.ansible.com:443</a>"
"email": "<a href="mailto:[email protected]">[email protected]</a>"

The fields are rendered normally with curl, so the "accepts" header is probably controlling this inadvertent templating.

To Reproduce
Spin up galaxy_ng from the master branch and open <prefix>_ui/v1/settings/ or <prefix>/_ui/v2/users/ in a browser window.

Expected behavior
Ideally, all fields returned by serializers return the same value+type whether it's via curl or a browser.

Additional context
https://issues.redhat.com/browse/AAH-3363

[mdellweg]

Are the links clickable in the Browser? That would be the expected result.

[mdellweg]

Can you tell curl to request the content type text/html? What would the result look like?

[jctanner]

The links are not clickable ...

$ curl -H 'Accept: text/html' -s -u admin:admin http://localhost:55001/api/galaxy/_ui/v1/settings/  | grep CONTENT
    "GALAXY_REQUIRE_CONTENT_APPROVAL": true,
    "ANSIBLE_CONTENT_HOSTNAME": "<a href="http://localhost:55001/pulp/content" rel="nofollow">http://localhost:55001/pulp/content</a>",
    "CONTENT_ORIGIN": "<a href="http://localhost:55001" rel="nofollow">http://localhost:55001</a>",

$ curl -H 'Accept: application/json' -s -u admin:admin http://localhost:55001/api/galaxy/_ui/v1/settings/  | jq . | grep CONTENT
  "GALAXY_REQUIRE_CONTENT_APPROVAL": true,
  "ANSIBLE_CONTENT_HOSTNAME": "http://localhost:55001/pulp/content",
  "CONTENT_ORIGIN": "http://localhost:55001",

[ggainey]

The <prefix>_ui/v1/settings/ or <prefix>/_ui/v2/users/ examples aren't (near as I can tell) Pulp-rendered. Assuming this is happening in the /pulp/api/v3/ calls, it's likely that we just need to backport the fix for #5664 to 3.49. In progress, see #5736.

[mdellweg]

#5736