0001-misc-switch-html-cleanup-to-bleach-58808.patch

Frédéric Péters, 27 novembre 2021 10:48

Voir les différences: en ligne côte à côte

Subject: [PATCH] misc: switch html cleanup to bleach (#58808)

 debian/control        |   2 +-
 setup.py              |   1 +
 tests/test_widgets.py |  52 +++----
 tox.ini               |   1 +
 wcs/qommon/form.py    | 310 +++++++++++++++++++++++++++++++++++++++++-
 5 files changed, 336 insertions(+), 30 deletions(-)

     Package: wcs
     Architecture: all
     Depends: graphviz,
              python3-bleach,
              python3-django (>= 1:1.11),
              python3-django-ckeditor,
              python3-django-ratelimit,
              python3-feedparser,
              python3-hobo,
              python3-lasso,
              python3-pil,

setup.py
168	168	maintainer_email="fpeters@entrouvert.com",
169	169	url="http://wcs.labs.libre-entreprise.org",
170	170	install_requires=[
	171	'bleach',
171	172	'gadjo>=0.53',
172	173	'django-ckeditor<4.5.4',
173	174	'django-ratelimit<3',

         assert not widget.has_error()
         assert widget.parse() == 'bla bla bla'
         import wcs.qommon.form
         widget = WysiwygTextWidget('test')
         mock_form_submission(req, widget, {'test': '<p>bla bla bla</p>'})
         assert not widget.has_error()
         assert widget.parse() == '<p>bla bla bla</p>'
         sanitize_html = wcs.qommon.form._sanitizeHTML
         if sanitize_html:
             widget = WysiwygTextWidget('test')
             mock_form_submission(req, widget, {'test': '<p>bla bla bla</p>'})
             assert not widget.has_error()
             assert widget.parse() == '<p>bla bla bla</p>'
         widget = WysiwygTextWidget('test')
         mock_form_submission(req, widget, {'test': '<a href="#">a</a>'})
         assert not widget.has_error()
         assert widget.parse() == '<a href="#">a</a>'
             widget = WysiwygTextWidget('test')
             mock_form_submission(req, widget, {'test': '<a href="#">a</a>'})
             assert not widget.has_error()
             assert widget.parse() == '<a href="#">a</a>'
         widget = WysiwygTextWidget('test')
         mock_form_submission(req, widget, {'test': '<a href="javascript:alert()">a</a>'})
         assert not widget.has_error()
         assert widget.parse() == '<a>a</a>'  # javascript: got filtered
             widget = WysiwygTextWidget('test')
             mock_form_submission(req, widget, {'test': '<a href="javascript:alert()">a</a>'})
             assert not widget.has_error()
             assert widget.parse() == '<a href="">a</a>'  # javascript: got filtered
         # check comments are kept
         widget = WysiwygTextWidget('test')
         mock_form_submission(req, widget, {'test': '<p>hello</p><!-- world --><p>.</p>'})
         assert not widget.has_error()
         assert widget.parse() == '<p>hello</p><!-- world --><p>.</p>'
         # check <script> are kept
         widget = WysiwygTextWidget('test')
         mock_form_submission(req, widget, {'test': '<p>hello</p><script>alert("test")</script>'})
         assert not widget.has_error()
         assert widget.parse() == '<p>hello</p><script>alert("test")</script>'
         # check <style> are kept
         widget = WysiwygTextWidget('test')
         mock_form_submission(req, widget, {'test': '<p>hello</p><style>p { color: blue; }</style>'})
         assert not widget.has_error()
         assert widget.parse() == '<p>hello</p><style>p { color: blue; }</style>'
         # check django syntax is kept intact
         widget = WysiwygTextWidget('test')
-...
             == '<a href="{% if 1 > 2 %}héllo{% endif %}">{% if 2 > 1 %}{{plop|date:"Y"}}{% endif %}</a>'
+        )
         # check we don't escape HTML if feedparser _sanitizeHTML is missing
         wcs.qommon.form._sanitizeHTML = None
         widget = WysiwygTextWidget('test')
         mock_form_submission(req, widget, {'test': '<p>bla bla bla</p>'})
         assert not widget.has_error()
         assert widget.parse() == '<p>bla bla bla</p>'
         wcs.qommon.form._sanitizeHTML = sanitize_html
     def test_select_hint_widget():
         widget = SingleSelectHintWidget(

tox.ini
44	44	Quixote>=3.0,<3.2
45	45	pre-commit
46	46	pyzbar
	47	bleach
47	48	commands =
48	49	py.test -v {env:COVERAGE:} --junitxml=junit-{envname}.xml {posargs:tests/}
49	50	pylint: ./pylint.sh wcs/ tests/

     except ImportError:
         Image = None
     try:
         from feedparser import _sanitizeHTML
     except ImportError:
         _sanitizeHTML = None
     import bleach
     try:
         import DNS
-...
     class WysiwygTextWidget(TextWidget):
         ALL_TAGS = [
             'a',
             'abbr',
             'acronym',
             'address',
             'area',
             'article',
             'aside',
             'audio',
             'b',
             'big',
             'blockquote',
             'br',
             'button',
             'canvas',
             'caption',
             'center',
             'cite',
             'code',
             'col',
             'colgroup',
             'command',
             'datagrid',
             'datalist',
             'dd',
             'del',
             'details',
             'dfn',
             'dialog',
             'dir',
             'div',
             'dl',
             'dt',
             'em',
             'event-source',
             'fieldset',
             'figcaption',
             'figure',
             'font',
             'footer',
             'form',
             'h1',
             'h2',
             'h3',
             'h4',
             'h5',
             'h6',
             'header',
             'hr',
             'i',
             'img',
             'input',
             'ins',
             'kbd',
             'keygen',
             'label',
             'legend',
             'li',
             'm',
             'map',
             'menu',
             'meter',
             'multicol',
             'nav',
             'nextid',
             'noscript',
             'ol',
             'optgroup',
             'option',
             'output',
             'p',
             'pre',
             'progress',
             'q',
             's',
             'samp',
             'script',
             'section',
             'select',
             'small',
             'sound',
             'source',
             'spacer',
             'span',
             'strike',
             'strong',
             'style',
             'sub',
             'sup',
             'table',
             'tbody',
             'td',
             'textarea',
             'tfoot',
             'th',
             'thead',
             'time',
             'tr',
             'tt',
             'u',
             'ul',
             'var',
             'video',
+        ]
         ALL_ATTRS = [
             'abbr',
             'accept',
             'accept-charset',
             'accesskey',
             'action',
             'align',
             'alt',
             'autocomplete',
             'autofocus',
             'axis',
             'background',
             'balance',
             'bgcolor',
             'bgproperties',
             'border',
             'bordercolor',
             'bordercolordark',
             'bordercolorlight',
             'bottompadding',
             'cellpadding',
             'cellspacing',
             'ch',
             'challenge',
             'char',
             'charoff',
             'charset',
             'checked',
             'choff',
             'cite',
             'class',
             'clear',
             'color',
             'cols',
             'colspan',
             'compact',
             'contenteditable',
             'controls',
             'coords',
             'data',
             'datafld',
             'datapagesize',
             'datasrc',
             'datetime',
             'default',
             'delay',
             'dir',
             'disabled',
             'draggable',
             'dynsrc',
             'enctype',
             'end',
             'face',
             'for',
             'form',
             'frame',
             'galleryimg',
             'gutter',
             'headers',
             'height',
             'hidden',
             'hidefocus',
             'high',
             'href',
             'hreflang',
             'hspace',
             'icon',
             'id',
             'inputmode',
             'ismap',
             'keytype',
             'label',
             'lang',
             'leftspacing',
             'list',
             'longdesc',
             'loop',
             'loopcount',
             'loopend',
             'loopstart',
             'low',
             'lowsrc',
             'max',
             'maxlength',
             'media',
             'method',
             'min',
             'multiple',
             'name',
             'nohref',
             'noshade',
             'nowrap',
             'open',
             'optimum',
             'pattern',
             'ping',
             'point-size',
             'poster',
             'pqg',
             'preload',
             'prompt',
             'radiogroup',
             'readonly',
             'rel',
             'repeat-max',
             'repeat-min',
             'replace',
             'required',
             'rev',
             'rightspacing',
             'rows',
             'rowspan',
             'rules',
             'scope',
             'selected',
             'shape',
             'size',
             'span',
             'src',
             'start',
             'step',
             'style',
             'summary',
             'suppress',
             'tabindex',
             'target',
             'template',
             'title',
             'toppadding',
             'type',
             'unselectable',
             'urn',
             'usemap',
             'valign',
             'value',
             'variable',
             'volume',
             'vrml',
             'vspace',
             'width',
             'wrap',
             'xml:lang',
+        ]
         ALL_STYLES = [
             'azimuth',
             'background-color',
             'border-bottom-color',
             'border-collapse',
             'border-color',
             'border-left-color',
             'border-right-color',
             'border-top-color',
             'clear',
             'color',
             'cursor',
             'direction',
             'display',
             'elevation',
             'float',
             'font',
             'font-family',
             'font-size',
             'font-style',
             'font-variant',
             'font-weight',
             'height',
             'letter-spacing',
             'line-height',
             'overflow',
             'pause',
             'pause-after',
             'pause-before',
             'pitch',
             'pitch-range',
             'richness',
             'speak',
             'speak-header',
             'speak-numeral',
             'speak-punctuation',
             'speech-rate',
             'stress',
             'text-align',
             'text-decoration',
             'text-indent',
             'unicode-bidi',
             'vertical-align',
             'voice-family',
             'volume',
             'white-space',
             'width',
+        ]
         def _parse(self, request):
             TextWidget._parse(self, request, use_validation_function=False)
             if self.value:
                 if _sanitizeHTML:
                     self.value = _sanitizeHTML(self.value, get_request().charset, 'text/html')
                 self.value = bleach.clean(
                     self.value,
                     tags=self.ALL_TAGS,
                     attributes=self.ALL_ATTRS,
                     styles=self.ALL_STYLES,
                     strip_comments=False,
+                )
                 if self.value.startswith('<br />'):
                     self.value = self.value[6:]
                 if self.value.endswith('<br />'):
+    -

Projet

Général

Profil

Produits Entr'ouvert » w.c.s.

0001-misc-switch-html-cleanup-to-bleach-58808.patch