dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed issue #999, gluon.sanitiizer.sanitze improvement, thanks macfiron

Browse Source
This commit is contained in:
mdipierro
2015-06-25 04:19:01 -05:00
parent b636a5d6e9
commit 23ddb6c3c2
1 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gluon/sanitizer.py
+19 -15
View File
@@ -66,14 +66,15 @@ class XssCleaner(HTMLParser):
#to strip or escape disallowed tags? #to strip or escape disallowed tags?
self.strip_disallowed = strip_disallowed self.strip_disallowed = strip_disallowed
self.in_disallowed = False # there might be data after final closing tag, that is to be ignored
self.in_disallowed = [True]
def handle_data(self, data): def handle_data(self, data):
if data and not self.in_disallowed: if data and not self.in_disallowed[-1]:
self.result += xssescape(data) self.result += xssescape(data)
def handle_charref(self, ref): def handle_charref(self, ref):
if self.in_disallowed: if self.in_disallowed[-1]:
return return
elif len(ref) < 7 and (ref.isdigit() or ref == 'x27'): # x27 is a special case for apostrophe elif len(ref) < 7 and (ref.isdigit() or ref == 'x27'): # x27 is a special case for apostrophe
self.result += '&#%s;' % ref self.result += '&#%s;' % ref
@@ -81,7 +82,7 @@ class XssCleaner(HTMLParser):
self.result += xssescape('&#%s' % ref) self.result += xssescape('&#%s' % ref)
def handle_entityref(self, ref): def handle_entityref(self, ref):
if self.in_disallowed: if self.in_disallowed[-1]:
return return
elif ref in entitydefs: elif ref in entitydefs:
self.result += '&%s;' % ref self.result += '&%s;' % ref
@@ -89,7 +90,7 @@ class XssCleaner(HTMLParser):
self.result += xssescape('&%s' % ref) self.result += xssescape('&%s' % ref)
def handle_comment(self, comment): def handle_comment(self, comment):
if self.in_disallowed: if self.in_disallowed[-1]:
return return
elif comment: elif comment:
self.result += xssescape('<!--%s-->' % comment) self.result += xssescape('<!--%s-->' % comment)
@@ -100,11 +101,11 @@ class XssCleaner(HTMLParser):
attrs attrs
): ):
if tag not in self.permitted_tags: if tag not in self.permitted_tags:
if self.strip_disallowed: self.in_disallowed.append(True)
self.in_disallowed = True if (not self.strip_disallowed):
else:
self.result += xssescape('<%s>' % tag) self.result += xssescape('<%s>' % tag)
else: else:
self.in_disallowed.append(False)
bt = '<' + tag bt = '<' + tag
if tag in self.allowed_attributes: if tag in self.allowed_attributes:
attrs = dict(attrs) attrs = dict(attrs)
@@ -119,6 +120,7 @@ class XssCleaner(HTMLParser):
else: else:
bt += ' %s=%s' % (xssescape(attribute), bt += ' %s=%s' % (xssescape(attribute),
quoteattr(attrs[attribute])) quoteattr(attrs[attribute]))
# deal with <a> without href and <img> without src
if bt == '<a' or bt == '<img': if bt == '<a' or bt == '<img':
return return
if tag in self.requires_no_close: if tag in self.requires_no_close:
@@ -129,10 +131,9 @@ class XssCleaner(HTMLParser):
def handle_endtag(self, tag): def handle_endtag(self, tag):
bracketed = '</%s>' % tag bracketed = '</%s>' % tag
self.in_disallowed.pop()
if tag not in self.permitted_tags: if tag not in self.permitted_tags:
if self.strip_disallowed: if (not self.strip_disallowed):
self.in_disallowed = False
else:
self.result += xssescape(bracketed) self.result += xssescape(bracketed)
elif tag in self.open_tags: elif tag in self.open_tags:
self.result += bracketed self.result += bracketed
@@ -143,10 +144,13 @@ class XssCleaner(HTMLParser):
Accepts relative, absolute, and mailto urls Accepts relative, absolute, and mailto urls
""" """
parsed = urlparse(url) if url.startswith('#'):
return (parsed[0] in self.allowed_schemes and '.' in parsed[1]) \ return True
or (parsed[0] in self.allowed_schemes and '@' in parsed[2]) \ else:
or (parsed[0] == '' and parsed[2].startswith('/')) parsed = urlparse(url)
return ((parsed[0] in self.allowed_schemes and '.' in parsed[1]) or
(parsed[0] in self.allowed_schemes and '@' in parsed[2]) or
(parsed[0] == '' and parsed[2].startswith('/')))
def strip(self, rawstring, escape=True): def strip(self, rawstring, escape=True):
""" """