dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed issue 1382, sanitizer accepts mailto, thanks lightdot

Browse Source
This commit is contained in:
mdipierro
2013-03-15 10:17:33 -05:00
parent f613a4cc99
commit f3af2a1999
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VERSION
+1 -1
View File
@@ -1 +1 @@
Version 2.4.4-stable+timestamp.2013.03.15.10.13.48 Version 2.4.4-stable+timestamp.2013.03.15.10.16.45
gluon/sanitizer.py
+3 -2
View File
@@ -66,7 +66,7 @@ class XssCleaner(HTMLParser):
# The only schemes allowed in URLs (for href and src attributes). # The only schemes allowed in URLs (for href and src attributes).
# Adding "javascript" or "vbscript" to this list would not be smart. # Adding "javascript" or "vbscript" to this list would not be smart.
self.allowed_schemes = ['http', 'https', 'ftp'] self.allowed_schemes = ['http', 'https', 'ftp', 'mailto']
#to strip or escape disallowed tags? #to strip or escape disallowed tags?
self.strip_disallowed = strip_disallowed self.strip_disallowed = strip_disallowed
@@ -151,11 +151,12 @@ class XssCleaner(HTMLParser):
def url_is_acceptable(self, url): def url_is_acceptable(self, url):
""" """
Accepts relative and absolute urls Accepts relative, absolute, and mailto urls
""" """
parsed = urlparse(url) parsed = urlparse(url)
return (parsed[0] in self.allowed_schemes and '.' in parsed[1]) \ return (parsed[0] in self.allowed_schemes and '.' in parsed[1]) \
or (parsed[0] in self.allowed_schemes and '@' in parsed[2]) \
or (parsed[0] == '' and parsed[2].startswith('/')) or (parsed[0] == '' and parsed[2].startswith('/'))
def strip(self, rawstring, escape=True): def strip(self, rawstring, escape=True):