display() should escape by default (#915)

- display(some_str) escapes the string by default. This is almost always what you want

- display(some_obj) calls repr(obj) and escapes the result. Again, it's a very sensible default

- if you want to inject some raw HTML in the output, you can use the new HTML class: display(HTML("<p>hello</p>")).

pyscriptjs/tests/integration/test_02_output.py

@@ -1,3 +1,4 @@
+import html
 import re
 
 import pytest
@@ -201,6 +202,30 @@ class TestOutput(PyScriptTest):
             == "['A', 1, '!']\n{'B': 2, 'List': ['A', 1, '!']}\n('C', 3, '!')"
         )
 
+    def test_display_should_escape(self):
+        self.pyscript_run(
+            """
+            <py-script>
+                display("<p>hello world</p>")
+            </py-script>
+            """
+        )
+        out = self.page.locator("py-script > div")
+        assert out.inner_html() == html.escape("<p>hello world</p>")
+        assert out.inner_text() == "<p>hello world</p>"
+
+    def test_display_HTML(self):
+        self.pyscript_run(
+            """
+            <py-script>
+                display(HTML("<p>hello world</p>"))
+            </py-script>
+            """
+        )
+        out = self.page.locator("py-script > div")
+        assert out.inner_html() == "<p>hello world</p>"
+        assert out.inner_text() == "hello world"
+
     def test_image_display(self):
         self.pyscript_run(
             """

pyscriptjs/tests/py-unit/test_pyscript.py

@@ -1,3 +1,4 @@
+import sys
 from unittest.mock import Mock
 
 import pyscript
@@ -24,7 +25,26 @@ class TestElement:
 
 def test_format_mime_str():
     obj = "just a string"
+    out, mime = pyscript.format_mime(obj)
+    assert out == obj
+    assert mime == "text/plain"
 
-    res = pyscript.format_mime(obj)
-    assert res[0] == obj
-    assert res[1] == "text/plain"
+
+def test_format_mime_str_escaping():
+    obj = "<p>hello</p>"
+    out, mime = pyscript.format_mime(obj)
+    assert out == "&lt;p&gt;hello&lt;/p&gt;"
+    assert mime == "text/plain"
+
+
+def test_format_mime_repr_escaping():
+    out, mime = pyscript.format_mime(sys)
+    assert out == "&lt;module 'sys' (built-in)&gt;"
+    assert mime == "text/plain"
+
+
+def test_format_mime_HTML():
+    obj = pyscript.HTML("<p>hello</p>")
+    out, mime = pyscript.format_mime(obj)
+    assert out == "<p>hello</p>"
+    assert mime == "text/html"