XSS / HTML injection when deleting a record ?

[GigiusB]

I was wondering how come in the
easyaudit.admin.CRUDEventAdmin.object_repr_link we escape the obj.object_repr only when the operation is not a CRUDEvent.DELETE.

For example: if you create a record with a field value of "<script>alert("Hello")</script>" and then you delete the record the javascript would be executed when going to the crudevent changelist!

def object_repr_link(self, obj):
        if obj.event_type == CRUDEvent.DELETE:
            html = obj.object_repr
        else:
            escaped_obj_repr = escape(obj.object_repr)
            try:
                content_type = self.get_content_type(obj)
                url = reverse("admin:%s_%s_change" % (
                    content_type.app_label,
                    content_type.model,
                ), args=(obj.object_id,))
                html = '<a href="%s">%s</a>' % (url, escaped_obj_repr)
            except Exception:
                html = escaped_obj_repr
        return mark_safe(html)