ORM Lens

DOL031 — render() with locals() as context

Default severity: warning · Applicability: suggestion · Category: forms

Detects render(request, "template.html", locals()). Passing locals() as the template context leaks every local variable in the view — querysets you only built halfway, loop temporaries, debugging placeholders, helper objects — into the template namespace. That hides the template’s real data contract, couples template variable names to view internals (rename a local, silently break the page), and can expose values that were never meant to render. An explicit dict documents exactly what the template needs. No QuickFix: only you know which locals the template actually uses.

Bad

def order_detail(request, pk):
    order = get_object_or_404(Order, pk=pk)
    items = order.items.select_related("product")
    return render(request, "orders/detail.html", locals())

Good

def order_detail(request, pk):
    order = get_object_or_404(Order, pk=pk)
    items = order.items.select_related("product")
    return render(request, "orders/detail.html", {"order": order, "items": items})

Suppress

# orm-lens-disable-next-line DOL031

Or per-workspace in .vscode/settings.json: {"djangoOrmLens.rules": {"DOL031": "off"}}.

This site is open source. Improve this page.