Code

Ticket #6514: 6514.diff

File 6514.diff, 6.4 KB (added by SmileyChris, 6 years ago)
Line 
1Index: django/utils/html.py
2===================================================================
3--- django/utils/html.py        (revision 7028)
4+++ django/utils/html.py        (working copy)
5@@ -102,18 +102,24 @@
6             if middle.startswith('www.') or ('@' not in middle and not middle.startswith('http://') and \
7                     len(middle) > 0 and middle[0] in string.ascii_letters + string.digits and \
8                     (middle.endswith('.org') or middle.endswith('.net') or middle.endswith('.com'))):
9-                middle = '<a href="http://%s"%s>%s</a>' % (
10-                        urlquote(middle, safe='/&=:;#?+'),  nofollow_attr,
11-                        trim_url(middle))
12+                middle = 'http://%s' % middle
13             if middle.startswith('http://') or middle.startswith('https://'):
14+                url = urlquote(middle, safe='/&=:;#?+')
15+                if autoescape and not safe_input:
16+                    url = escape(url)
17+                trimmed_url = trim_url(middle)
18                 middle = '<a href="%s"%s>%s</a>' % (
19-                        urlquote(middle, safe='/&=:;#?+'), nofollow_attr,
20-                        trim_url(middle))
21-            if '@' in middle and not middle.startswith('www.') and \
22-                    not ':' in middle and simple_email_re.match(middle):
23+                            url, nofollow_attr, trimmed_url
24+                        )
25+            elif '@' in middle and not middle.startswith('www.') and \
26+                      not ':' in middle and simple_email_re.match(middle):
27+                if autoescape:
28+                    middle = conditional_escape(middle)
29                 middle = '<a href="mailto:%s">%s</a>' % (middle, middle)
30             if lead + middle + trail != word:
31-                words[i] = lead + middle + trail
32+                if autoescape and not safe_input:
33+                    lead, trail = escape(lead), escape(trail)
34+                words[i] = mark_safe(lead + middle + trail)
35             elif autoescape and not safe_input:
36                 words[i] = escape(word)
37         elif safe_input:
38Index: tests/regressiontests/templates/filters.py
39===================================================================
40--- tests/regressiontests/templates/filters.py  (revision 7028)
41+++ tests/regressiontests/templates/filters.py  (working copy)
42@@ -98,8 +98,8 @@
43         'filter-upper01': ('{% autoescape off %}{{ a|upper }} {{ b|upper }}{% endautoescape %}', {"a": "a & b", "b": mark_safe("a &amp; b")}, u"A & B A &AMP; B"),
44         'filter-upper02': ('{{ a|upper }} {{ b|upper }}', {"a": "a & b", "b": mark_safe("a &amp; b")}, u"A &amp; B A &amp;AMP; B"),
45 
46-        'filter-urlize01': ('{% autoescape off %}{{ a|urlize }} {{ b|urlize }}{% endautoescape %}', {"a": "http://example.com/x=&y=", "b": mark_safe("http://example.com?x=&y=")}, u'<a href="http://example.com/x=&y=" rel="nofollow">http://example.com/x=&y=</a> <a href="http://example.com?x=&y=" rel="nofollow">http://example.com?x=&y=</a>'),
47-        'filter-urlize02': ('{{ a|urlize }} {{ b|urlize }}', {"a": "http://example.com/x=&y=", "b": mark_safe("http://example.com?x=&y=")}, u'<a href="http://example.com/x=&y=" rel="nofollow">http://example.com/x=&amp;y=</a> <a href="http://example.com?x=&y=" rel="nofollow">http://example.com?x=&y=</a>'),
48+        'filter-urlize01': ('{% autoescape off %}{{ a|urlize }} {{ b|urlize }}{% endautoescape %}', {"a": "http://example.com/x=&y=", "b": mark_safe("http://example.com?x=&amp;y=")}, u'<a href="http://example.com/x=&y=" rel="nofollow">http://example.com/x=&y=</a> <a href="http://example.com?x=&amp;y=" rel="nofollow">http://example.com?x=&amp;y=</a>'),
49+        'filter-urlize02': ('{{ a|urlize }} {{ b|urlize }}', {"a": "http://example.com/?x=&y=", "b": mark_safe("http://example.com?x=&amp;y=")}, u'<a href="http://example.com/?x=&amp;y=" rel="nofollow">http://example.com/?x=&amp;y=</a> <a href="http://example.com?x=&amp;y=" rel="nofollow">http://example.com?x=&amp;y=</a>'),
50         'filter-urlize03': ('{% autoescape off %}{{ a|urlize }}{% endautoescape %}', {"a": mark_safe("a &amp; b")}, 'a &amp; b'),
51         'filter-urlize04': ('{{ a|urlize }}', {"a": mark_safe("a &amp; b")}, 'a &amp; b'),
52 
53@@ -109,7 +109,7 @@
54         'filter-urlize06': ('{{ a|urlize }}', {"a": "<script>alert('foo')</script>"}, '&lt;script&gt;alert(&#39;foo&#39;)&lt;/script&gt;'),
55 
56         'filter-urlizetrunc01': ('{% autoescape off %}{{ a|urlizetrunc:"8" }} {{ b|urlizetrunc:"8" }}{% endautoescape %}', {"a": '"Unsafe" http://example.com/x=&y=', "b": mark_safe('&quot;Safe&quot; http://example.com?x=&y=')}, u'"Unsafe" <a href="http://example.com/x=&y=" rel="nofollow">http:...</a> &quot;Safe&quot; <a href="http://example.com?x=&y=" rel="nofollow">http:...</a>'),
57-        'filter-urlizetrunc02': ('{{ a|urlizetrunc:"8" }} {{ b|urlizetrunc:"8" }}', {"a": '"Unsafe" http://example.com/x=&y=', "b": mark_safe('&quot;Safe&quot; http://example.com?x=&y=')}, u'&quot;Unsafe&quot; <a href="http://example.com/x=&y=" rel="nofollow">http:...</a> &quot;Safe&quot; <a href="http://example.com?x=&y=" rel="nofollow">http:...</a>'),
58+        'filter-urlizetrunc02': ('{{ a|urlizetrunc:"8" }} {{ b|urlizetrunc:"8" }}', {"a": '"Unsafe" http://example.com/?x=&y=', "b": mark_safe('&quot;Safe&quot; http://example.com?x=&y=')}, u'&quot;Unsafe&quot; <a href="http://example.com/?x=&amp;y=" rel="nofollow">http:...</a> &quot;Safe&quot; <a href="http://example.com?x=&y=" rel="nofollow">http:...</a>'),
59 
60         'filter-wordcount01': ('{% autoescape off %}{{ a|wordcount }} {{ b|wordcount }}{% endautoescape %}', {"a": "a & b", "b": mark_safe("a &amp; b")}, "3 3"),
61         'filter-wordcount02': ('{{ a|wordcount }} {{ b|wordcount }}', {"a": "a & b", "b": mark_safe("a &amp; b")}, "3 3"),
62@@ -240,7 +240,7 @@
63         'chaining13': ('{{ a|safe|force_escape }}', {"a": "a < b"}, "a &lt; b"),
64         'chaining14': ('{% autoescape off %}{{ a|safe|force_escape }}{% endautoescape %}', {"a": "a < b"}, "a &lt; b"),
65 
66-        # Filters decorated with stringfilter still respect is_safe.
67+        # Filters decorated with stringfilter still respect is_safe.
68         'autoescape-stringfilter01': (r'{{ unsafe|capfirst }}', {'unsafe': UnsafeClass()}, 'You &amp; me'),
69         'autoescape-stringfilter02': (r'{% autoescape off %}{{ unsafe|capfirst }}{% endautoescape %}', {'unsafe': UnsafeClass()}, 'You & me'),
70         'autoescape-stringfilter03': (r'{{ safe|capfirst }}', {'safe': SafeClass()}, 'You &gt; me'),