Expand and modify escaping of JavaScript strings in the escapejs filter

[Mike Wiacek <mjwiacek@…>]

The escapejs filter currently escapes a small subset of characters to prevent JavaScript injection. However, the resulting strings can still contain valid HTML, leading to XSS vulnerabilities. Using hex encoding as opposed to backslash escaping, effectively prevents Javascript injection and also helps prevent XSS. Attached is a small patch that modifies the _js_escapes tuple to use hex encoding on an expanded set of characters.

[Mike Wiacek <mjwiacek@…>]

Version 1 didn't escape \'s first. Version 2 fixes this.

[Collin Grady]

added tests

[Malcolm Tredinnick]

That big table of mappings is a little unwieldy (all the hex code mappings). Would be good if that could be generated programmatically so that we have confidence there are no typos in there. I'm just talking about the \x01 -> "\x01" pieces.

[Eric Holscher]

for x in range(32):

print "%02X" % x

Should do it. I'll make a patch later tonight if need be.

[mjwiacek@…]

Working on a shorter version now.

[mjwiacek]

Same as 7177.diff with an update to the AUTHORS files and a self generating _js_escapes tuple.

[mjwiacek]

Just note that I renamed _js_escapes to _base_js_escapes so that when the remaining escaping rules are programmatically generated, we don't end up with duplicate entries. The end result is the same, a tuple called _js_escapes.

[Eric Holscher]

Combining the code into one function

[Eric Holscher]

Attached a diff that combines the code into one function. Also added myself to the AUTHORS file as well, because of my work on #7416 and lots of trac help.

[mjwiacek]

I'd argue the second to most recent version is more readable. If you choose to go with the more concise version, I'd add comments so it's clear whats happening.

[Malcolm Tredinnick]

(In [8577]) Fixed #7177 -- Added extra robustness to the escapejs filter so that all
invalid characters are correctly escaped. This avoids any chance to inject raw
HTML inside <script> tags. Thanks to Mike Wiacek for the patch and Collin Grady
for the tests.

[Jacob]

Milestone 1.0 deleted

[Mariusz Felisiak <felisiak.mariusz@…>]

In adfb3dfa:

Fixed #33405, Refs #7177 -- Clarified docs for filter escapejs regarding safe and unsafe usages.

[Mariusz Felisiak <felisiak.mariusz@…>]

In e54f711:

[4.2.x] Fixed #33405, Refs #7177 -- Clarified docs for filter escapejs regarding safe and unsafe usages.

Backport of adfb3dfa89b62ee0c838a64d3d480c03dd3ec869 from main