Django

Code

Changeset 8577

Show
Ignore:
Timestamp:
08/26/08 02:56:32 (3 months ago)
Author:
mtredinnick
Message:

Fixed #7177 -- Added extra robustness to the escapejs filter so that all
invalid characters are correctly escaped. This avoids any chance to inject raw
HTML inside <script> tags. Thanks to Mike Wiacek for the patch and Collin Grady
for the tests.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • django/trunk/django/template/defaultfilters.py

    r8535 r8577  
    6363capfirst = stringfilter(capfirst) 
    6464 
    65 _js_escapes = ( 
    66     ('\\', '\\\\'), 
    67     ('"', '\\"'), 
    68     ("'", "\\'"), 
    69     ('\n', '\\n'), 
    70     ('\r', '\\r'), 
    71     ('\b', '\\b'), 
    72     ('\f', '\\f'), 
    73     ('\t', '\\t'), 
    74     ('\v', '\\v'), 
    75     ('</', '<\\/'), 
     65_base_js_escapes = ( 
     66    ('\\', r'\x5C'), 
     67    ('\'', r'\x27'), 
     68    ('"', r'\x22'), 
     69    ('>', r'\x3E'), 
     70    ('<', r'\x3C'), 
     71    ('&', r'\x26'), 
     72    ('=', r'\x3D'), 
     73    ('-', r'\x2D'), 
     74    (';', r'\x3B') 
    7675) 
     76 
     77# Escape every ASCII character with a value less than 32. 
     78_js_escapes = (_base_js_escapes + 
     79               tuple([('%c' % z, '\\x%02X' % z) for z in range(32)])) 
     80 
    7781def escapejs(value): 
    78     """Backslash-escapes characters for use in JavaScript strings.""" 
     82    """Hex encodes characters for use in JavaScript strings.""" 
    7983    for bad, good in _js_escapes: 
    8084        value = value.replace(bad, good) 

  • django/trunk/tests/regressiontests/templates/filters.py

    r8556 r8577  
    263263        'autoescape-stringfilter03': (r'{{ safe|capfirst }}', {'safe': SafeClass()}, 'You &gt; me'), 
    264264        'autoescape-stringfilter04': (r'{% autoescape off %}{{ safe|capfirst }}{% endautoescape %}', {'safe': SafeClass()}, 'You &gt; me'), 
     265 
     266        'escapejs01': (r'{{ a|escapejs }}', {'a': 'testing\r\njavascript \'string" <b>escaping</b>'}, 'testing\\x0D\\x0Ajavascript \\x27string\\x22 \\x3Cb\\x3Eescaping\\x3C/b\\x3E'), 
     267        'escapejs02': (r'{% autoescape off %}{{ a|escapejs }}{% endautoescape %}', {'a': 'testing\r\njavascript \'string" <b>escaping</b>'}, 'testing\\x0D\\x0Ajavascript \\x27string\\x22 \\x3Cb\\x3Eescaping\\x3C/b\\x3E'), 
    265268    } 
    266269