Changeset 6683

Timestamp:

11/17/07 06:12:40 (1 year ago)

Author:

mtredinnick

Message:

Fixed some missed auto-escaping and URL quoting cases in the urlize filter.

Files:

• django/trunk/django/utils/html.py (modified) (2 diffs)
• django/trunk/tests/regressiontests/templates/filters.py (modified) (1 diff)

django/trunk/django/utils/html.py

@@ -7 +7 @@
-from django.utils.encoding import force_unicode
-from django.utils.functional import allow_lazy
+from django.utils.http import urlquote
-
-# Configuration for urlize() function
@@ -102 +103 @@
-                    len(middle) > 0 and middle[0] in string.letters + string.digits and \
-                    (middle.endswith('.org') or middle.endswith('.net') or middle.endswith('.com'))):
-
+
+
+
-            if middle.startswith('http://') or middle.startswith('https://'):
-
-
-
+
+
+
+
+
-                middle = '<a href="mailto:%s">%s</a>' % (middle, middle)
-            if lead + middle + trail != word:
-                words[i] = lead + middle + trail
+            elif autoescape and not safe_input:
+                words[i] = escape(word)
+        elif safe_input:
+            words[i] = mark_safe(word)
+        elif autoescape:
+            words[i] = escape(word)
-    return u''.join(words)
-urlize = allow_lazy(urlize, unicode)

django/trunk/tests/regressiontests/templates/filters.py

@@ -95 +95 @@
-        'filter-urlize04': ('{{ a|urlize }}', {"a": mark_safe("a & b")}, 'a & b'),
-
+        # This will lead to a nonsense result, but at least it won't be
+        # exploitable for XSS purposes when auto-escaping is on.
+        'filter-urlize05': ('{% autoescape off %}{{ a|urlize }}{% endautoescape %}', {"a": "<script>alert('foo')</script>"}, "<script>alert('foo')</script>"),
+        'filter-urlize06': ('{{ a|urlize }}', {"a": "<script>alert('foo')</script>"}, '&lt;script&gt;alert(&#39;foo&#39;)&lt;/script&gt;'),
+
-        'filter-urlizetrunc01': ('{% autoescape off %}{{ a|urlizetrunc:"8" }} {{ b|urlizetrunc:"8" }}{% endautoescape %}', {"a": "http://example.com/x=&y=", "b": mark_safe("http://example.com?x=&y=")}, u'<a href="http://example.com/x=&y=" rel="nofollow">http:...</a> <a href="http://example.com?x=&y=" rel="nofollow">http:...</a>'),
-        'filter-urlizetrunc02': ('{{ a|urlizetrunc:"8" }} {{ b|urlizetrunc:"8" }}', {"a": "http://example.com/x=&y=", "b": mark_safe("http://example.com?x=&y=")}, u'<a href="http://example.com/x=&y=" rel="nofollow">http:...</a> <a href="http://example.com?x=&y=" rel="nofollow">http:...</a>'),