fix: Validate component names

Author: fsbraun

djangocms_frontend/templatetags/cms_component.py

@@ -30,6 +30,10 @@ class based on the implate it is part of. The component class is generated
     if "_cms_components" in context:
         if len(args) != 1:  # pragma: no cover
             raise ValueError("The cms_component tag requires exactly one positional argument: the component name.")
+        if not isinstance(args[0], str):
+            raise ValueError("The component name must be a string.")
+        if not args[0].isidentifier():
+            raise ValueError("The component name must be a valid Python identifier.")
         context["_cms_components"]["cms_component"].append((args, kwargs))
     return ""
 

tests/test_autocomponent.py

@@ -107,6 +107,34 @@ def test_multiple_cms_component_tags_error(self):
         with self.assertRaises(TemplateSyntaxError):
             Template(invalid_template)
 
+    def test_cms_component_invalid_identifier(self):
+        # Test that cms_component tag raises ValueError for invalid identifiers
+        from django.template import Context
+        from djangocms_frontend.templatetags.cms_component import cms_component
+
+        context = Context({"_cms_components": {"cms_component": []}})
+
+        # Valid identifier should work
+        cms_component(context, "valid_name")
+        self.assertEqual(len(context["_cms_components"]["cms_component"]), 1)
+
+        # Invalid identifiers should raise ValueError
+        with self.assertRaises(ValueError) as cm:
+            cms_component(context, "invalid-name")
+        self.assertIn("valid Python identifier", str(cm.exception))
+
+        with self.assertRaises(ValueError) as cm:
+            cms_component(context, "123invalid")
+        self.assertIn("valid Python identifier", str(cm.exception))
+
+        with self.assertRaises(ValueError) as cm:
+            cms_component(context, "invalid name")
+        self.assertIn("valid Python identifier", str(cm.exception))
+
+        with self.assertRaises(ValueError) as cm:
+            cms_component(context, "")
+        self.assertIn("valid Python identifier", str(cm.exception))
+
     def test_component_folder_selection(self):
         from djangocms_frontend.component_pool import find_cms_component_templates