Ticket #15182: 15182_v2.diff

django/forms/widgets.py

@@ -332 +332 @@
             substitutions['initial'] = (u'<a href="%s">%s</a>'
                                         % (value.url, value))
             if not self.is_required:
-                checkbox_name = self.clear_checkbox_name(name)
+                # Since the checkbox label bypasses the usual widget
+                # attribute machinery, make sure it's escaped.
+                checkbox_name = self.clear_checkbox_name(conditional_escape(name))
                 checkbox_id = self.clear_checkbox_id(checkbox_name)
                 substitutions['clear_checkbox_name'] = checkbox_name
                 substitutions['clear_checkbox_id'] = checkbox_id

tests/regressiontests/forms/tests/widgets.py

@@ -1086 +1086 @@
         self.assertEqual(widget.render('myfile', FakeFieldFile()),
                          u'Currently: <a href="something">something</a> <input type="checkbox" name="myfile-clear" id="myfile-clear_id" /> <label for="myfile-clear_id">Clear</label><br />Change: <input type="file" name="myfile" />')
 
+    def test_clear_input_label_escaped(self):
+        widget = ClearableFileInput()
+        widget.is_required = False
+        xss_string = '''myfile"><script>alert('oops')</script><br name=".jpg'''
+        output = widget.render('">a_nasty_attack.jpg"', FakeFieldFile())
+        self.assertTrue(xss_string not in output)
+
     def test_clear_input_renders_only_if_not_required(self):
         """
         A ClearableFileInput with is_required=False does not render a clear