[khayashi4337]

Mustache's {{...}} HTML-escapes its value. The Connexion server templates write property and parameter names into Python string literals that way, so a model property named a&b produces

self.attribute_map = {
    'ab': 'a&b'
}

and from_dict({'a&b': 'x'}) silently drops the value (ab is None). A ' in a name becomes '.

Changes

• These names are now rendered with {{{...}}} from vendor extensions that hold them escaped for a single-quoted Python literal. The escaping is lossless: \, ', newline, CR, tab and other control characters. It is used for:
  • the model attribute_map (python-flask, python-aiohttp, python-blueplanet);
  • the query keys in the generated controller tests (python-flask, python-aiohttp), and the header names in python-blueplanet's generated tests.
• Parameters get x-python-connexion-quoted-name, with the same name and meaning as in feat(python-flask, python-aiohttp): deserialize object-typed query and header parameters #25427. That PR covers the header/cookie lookups in the python-flask/python-aiohttp controllers and tests, so this PR leaves those lines alone to avoid conflicts.
• The generated tests sent an apiKey under the security scheme's name instead of its header name (keyParamName). With scheme apiKeyAuth and header X-Api-Key, the generated test got 401. They now send keyParamName, and only for apiKeys in a header.

Verification

• Python*Test / AbstractPython*Test pass. A new spec has properties a&b, o'k, back\slash, dq"x and unicodeé, a query parameter q&we's, a header X-A&B'Head, and an apiKey header X-A&B'Key; the test asserts the rendered names for all three generators, plus a unit test for the escaper. The tests fail without the template change.
• For python-flask, python-aiohttp and python-blueplanet, all generated .py files pass python -m compileall. For python-flask, on Connexion 2.14.2, EscapedNames.from_dict({...}) keeps all five values, and before the change they were dropped.
• bin/generate-samples.sh bin/configs/python*.yaml produces no diff; no sample uses such names.

Not changed (known)

• apiKeys in a query parameter or a cookie are still not sent by the generated tests, as before.
• info.title is still HTML-escaped where it goes into a Python literal (arguments={'title': ...}). This only affects the Swagger UI title.

PR checklist

• Read the contribution guidelines.
• Run the following to build the project and update samples:

  ./mvnw clean package || exit
  ./bin/generate-samples.sh ./bin/configs/*.yaml || exit
  ./bin/utils/export_docs_generators.sh || exit
  

  Regenerated all bin/configs/python*.yaml samples: no diff. Generator options and docs are unchanged.
• If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

cc @cbornet @tomplus @krjakbrjak @fa0311 (Python technical committee)

Parts of this change were drafted with AI coding assistants (Devin, Claude Code, with reviews by Codex and Fable) and reviewed and verified by me.

🤖 Generated with Claude Code

---

Summary by cubic

Stops Mustache's HTML escaping from corrupting property, parameter, and apiKey names in generated Python Connexion servers. Names like a&b or o'k were written into Python string literals as a&b or o'k, so from_dict silently dropped such values and generated tests sent wrong keys. These names are now escaped losslessly for single-quoted Python literals via vendor extensions.

Bug Fixes

• The model attribute_map in python-flask, python-aiohttp, and python-blueplanet now renders the escaped wire name; query keys, blueplanet header/cookie names in generated tests, and blueplanet controller lookups use x-python-connexion-quoted-name to match feat(python-flask, python-aiohttp): deserialize object-typed query and header parameters #25427.
• Generated tests now send query params and apiKey tokens (in query or header) under their wire names instead of the security scheme name or the sanitized Python parameter name; apiKeys in a cookie are still not sent, and info.title remains HTML-escaped in the Swagger UI title.
• Escaping is lossless for backslash, quote, and control characters via a new escapeForPythonSingleQuotedLiteral, covered by unit tests and generated-file assertions for all three generators.

^{Written for commit 2a344aa. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 9 files

_{View guided diff | Re-trigger cubic}

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[khayashi4337]

Follow-up commit d004e66 for the python-blueplanet server, which was still using HTML-escaped names where python-flask and python-aiohttp already emit the escaped Python literal:

• controllers/controller.mustache: headers.get('{{baseName}}' / cookies.get('{{baseName}}' now use '{{{vendorExtensions.x-python-connexion-quoted-name}}}', like python-flask. A header named X-A&B'Head used to be looked up as X-A&B'Head and is now X-A&B\'Head.
• test/controller_test.mustache: the generated test sent the sanitized parameter name as the query name; it now sends the wire name (q&we\'s).
• escaped-names.yaml gained a cookie parameter (X-C&oo'kie); the escaped-names test now also checks the blueplanet controller and test, and runs python3 -m py_compile on them (the syntax check runs after the content assertions and is skipped when python3 is not available). With the template change reverted, the new assertion fails.

CI on the new head is green (11/11).