Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
erp5
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Labels
Merge Requests
140
Merge Requests
140
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Analytics
Analytics
CI / CD
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Jobs
Commits
Open sidebar
nexedi
erp5
Commits
3d6e97ba
Commit
3d6e97ba
authored
Jan 28, 2016
by
Tristan Cavelier
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
allow data urls in src attributes of img safe html tags
parent
186bbf46
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
7 additions
and
1 deletion
+7
-1
product/ERP5OOo/tests/testDms.py
product/ERP5OOo/tests/testDms.py
+5
-0
product/PortalTransforms/transforms/safe_html.py
product/PortalTransforms/transforms/safe_html.py
+2
-1
No files found.
product/ERP5OOo/tests/testDms.py
View file @
3d6e97ba
...
@@ -1724,6 +1724,7 @@ class TestDocument(TestDocumentMixin):
...
@@ -1724,6 +1724,7 @@ class TestDocument(TestDocumentMixin):
<a onclick="javascript:DosomethingNasty()">Another Link</a>
<a onclick="javascript:DosomethingNasty()">Another Link</a>
<p>éàèù</p>
<p>éàèù</p>
<p class="Thèmes Thèmes">Thèmes Thèmes</p>
<p class="Thèmes Thèmes">Thèmes Thèmes</p>
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABsAAAAbCAIAAAACtmMCAAAGmklEQVRIiYXWSYwcVxkH8O+9V6+qurbepmfs8WQyduxgJ4AnyLEdCyl2HBEJriwSixB3jggkfIjEARFxCRyAwA0hEYKMFBSioCCQjSNvsbzEdvAy45lkxtPT3dPd1bW8V2/lYEtIkVH+9/9P3+mvDxVFAf8n40k1SittkFKgtTXW+C6iFPseacSu7zuPbKFHiv0tvrZRpFlhjQkDHwGilFCXAFgAsMbyotC8nF9ob9/R+RSxYHLlo1xZggCEkkYpz6WiEpub62C1MSpOGq3mVDlJyzwTUtTr8eIXdgeB92hxNObnLt1tNzthFCFkpVYVZ6vLt86dOfXBtUt5PuGsqjfazx87fujgc54XamOkEBjZA88+OdVpfFIcp/z8xaVxOm61Op3pju95RTF556033v373/q9nlRKKWON1lq5bu1z+xe/+e3vNZtt0CIbjxljL3zpuW3bOwBATpw4AQDDYXr631eGg25VZul4pLQCBO+f++c/3j45Ho4xwsZYa7S1BiFsrb2/vsbLbNf8TJkNgbi0lqysdhd2zrrUwQ8OPPPeNc5Fs729MzMfRQ3G2OrSrRtXzhGwgUfjwI1DjziYEGKMEUIorS6cP3f71odSKsYZr5iU1elTlwEAA8Dt26tZxrQSgDB1a0GUBGGUpaPN7kZZybwssFXYKGu01YqAIUgbrSZ5trS8QqhPCGHFmCAtWLa+tukAwNmz72upiyJjZVZvzIRxExGc55PBKB1ujUMsP78wu3J/OErzkOIgcCptR6yqtF1auXcwz+Oo7jpOkaXZiJ8/PXb6g7TISyOZ70esSD3q14IoqMVgNEa4GQVfPba4b7516sIHg9FEK12jOOcVQdjBpuIyrjcBXLBEGzbeGuR56qytb9Wb2wcbd5FRCAznudHS8/xdncbibCtuJUcPPTPsrUvOAwfvfmK25HLENps+KiqBMAbsuV5oijRO2hiRvJw4lYAwSvIwMaryXNdoyYuM82JbI9q/I2EeTXwwob+4e2737La9T3/m7KWbm4MUYRTHwWMLO6QoMXE4mwAiylqHAPnOd7+vlDRKa608P/BqMSaEc54k8Y7QTndiSqAqsnQ4HA9TjJ3l5XUpqlbkCwtx4rNyODP7hF9LXNenrtfv3XOUgiSpS86sloAspR71AmtMrmm3tPMJohQqlo8nhR9G712+fvn2eiPwpKpKYfv9npQqmbq577MHBeP1uD49PYd7vR5jIojiqN70/AAZ6Tm4UW8KqV87+e7bZ64xVnDJe3lZCa1KTTEphMqlDRuNOAytVbduXsrSrVazwVhJECXPH32RM04wppQiQIJn1to4aVqAe/dWsJosTAdCVkHouwRfvb024cIg6/hee2bKdVDJi8FggAAlcRQnzbjeJt/4+reySTYeDpBVfhAQgl3XrzdbtaDW6Mwb68l81Ot32502xmSYFhPGLXFqzamCM6OlFzbGBR8O1nrdZQzG931n58JjV0fXaz5Nh/eN4UncotShFEou7nYnK1vJxY2ou5wSfcdokRfccUhUj5AfV8WE55kvAQMN4qmsVP+5cTEddZ09exZW7n1sjPaITrc2A79Gw1Cw8vqFC+MP70DKdF5Z5K0NdF5OMDaUkAqwQ7uuSzNZWYv2Pv3s/J7FkrOlmxc2eiOn2YzKrNvf3HCQRoB760vZuNcbZO/89U1VZDUMDlhPmchRkhKutJLaTti2dj32qeckCEgcuBRVRpZhGIHOHQDYu3fn2X+9VQmpLVXG6fbT+xv9vMgJRsgYCsZDoK1BRhOLDICQemVjFEe10POV1Cu3ri7fubKVi5pHf/DDH2EAOPzFo9ppXr8zunKze/nG6urHm0WeaSWU1MpAadBImcrYhkNnPbdNcYyRZnxrKyOOhzByCKLIYF12pjpHj7/0cMPX1u5/5ctfGw1HYMFoq7VCCADAWoswAgxaCQ/BlOcGhEitlTW1KNi+axphqawGbLyg9uov/zAzM/twcefmZl/77S+01qJiUnFjtDHGGGOttdYCEELcyqKuEF0h+1JhTPbOPQ40LImEUNpA//SV38zMzD5c3Ac5fPjAn0/+PklCCwrQQ8sisADWggWMEAFEJMG5VkybmpC7m3OCTVdV8PKPf7Vz4ckHzv9EADhy5NBf3vzTU0/tAzCADCB46FoN1gDC1oIFizEeSfFRf9CS8oUjx37369cX9x/4lA/g9T++8fNXXl1b3wBAAIAQAkCAEIAGMMgia83+XY//7CcvP/PS8U90/wv0LRSL/rwEwgAAAABJRU5ErkJggg==" />
</body>
</body>
</html>
</html>
"""
.
decode
(
'utf-8'
).
encode
(
'iso-8859-1'
)
"""
.
decode
(
'utf-8'
).
encode
(
'iso-8859-1'
)
...
@@ -1757,6 +1758,8 @@ class TestDocument(TestDocumentMixin):
...
@@ -1757,6 +1758,8 @@ class TestDocument(TestDocumentMixin):
self
.
assertTrue
(
'alert("da");'
not
in
safe_html
)
self
.
assertTrue
(
'alert("da");'
not
in
safe_html
)
self
.
assertTrue
(
'javascript:DosomethingNasty()'
not
in
safe_html
)
self
.
assertTrue
(
'javascript:DosomethingNasty()'
not
in
safe_html
)
self
.
assertTrue
(
'onclick'
not
in
safe_html
)
self
.
assertTrue
(
'onclick'
not
in
safe_html
)
self
.
assertTrue
(
'<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABsAAAAbCAIAAAACtmMCAAAG'
in
safe_html
)
self
.
assertTrue
(
'7CcvP/PS8U90/wv0LRSL/rwEwgAAAABJRU5ErkJggg=="'
in
safe_html
)
# Check that outputed entire html is safe
# Check that outputed entire html is safe
entire_html
=
web_page
.
asEntireHTML
()
entire_html
=
web_page
.
asEntireHTML
()
...
@@ -1773,6 +1776,8 @@ class TestDocument(TestDocumentMixin):
...
@@ -1773,6 +1776,8 @@ class TestDocument(TestDocumentMixin):
self
.
assertTrue
(
'alert("da");'
not
in
entire_html
)
self
.
assertTrue
(
'alert("da");'
not
in
entire_html
)
self
.
assertTrue
(
'javascript:DosomethingNasty()'
not
in
entire_html
)
self
.
assertTrue
(
'javascript:DosomethingNasty()'
not
in
entire_html
)
self
.
assertTrue
(
'onclick'
not
in
entire_html
)
self
.
assertTrue
(
'onclick'
not
in
entire_html
)
self
.
assertTrue
(
'<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABsAAAAbCAIAAAACtmMCAAAG'
in
safe_html
)
self
.
assertTrue
(
'7CcvP/PS8U90/wv0LRSL/rwEwgAAAABJRU5ErkJggg=="'
in
safe_html
)
# now check converted value is stored in cache
# now check converted value is stored in cache
format
=
'html'
format
=
'html'
...
...
product/PortalTransforms/transforms/safe_html.py
View file @
3d6e97ba
...
@@ -217,7 +217,8 @@ class StrippingParser(HTMLParser):
...
@@ -217,7 +217,8 @@ class StrippingParser(HTMLParser):
else
:
raise
IllegalHTML
,
'Script event "%s" not allowed.'
%
k
else
:
raise
IllegalHTML
,
'Script event "%s" not allowed.'
%
k
elif
v
is
None
:
elif
v
is
None
:
self
.
result
.
append
(
' %s'
%
k
)
self
.
result
.
append
(
' %s'
%
k
)
elif
remove_script
and
hasScript
(
v
):
elif
remove_script
and
hasScript
(
v
)
and
\
not
(
k
.
lower
()
==
'src'
and
tag
.
lower
()
==
'img'
):
if
not
self
.
raise_error
:
continue
if
not
self
.
raise_error
:
continue
else
:
raise
IllegalHTML
,
'Script URI "%s" not allowed.'
%
v
else
:
raise
IllegalHTML
,
'Script URI "%s" not allowed.'
%
v
else
:
else
:
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment