From 71a92f46e4e223a3bad0e27ececa2ece3c09f5d1 Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Mon, 31 Dec 2012 16:44:51 +0100 Subject: [PATCH 1/4] [FIX] tools: html_sanitize bzr revid: chm@openerp.com-20121231154451-0guqjid92rfndghp --- openerp/tests/test_mail.py | 8 ++++++++ openerp/tools/mail.py | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/openerp/tests/test_mail.py b/openerp/tests/test_mail.py index 50db556d234..c0ba042c198 100644 --- a/openerp/tests/test_mail.py +++ b/openerp/tests/test_mail.py @@ -229,6 +229,14 @@ class TestSanitizer(unittest2.TestCase): for attr in ['javascript']: self.assertNotIn(attr, sanitized_html, 'html_sanitize did not remove enough unwanted attributes') + emails =[("Charles ", "

Charles <charles.bidule@truc.fr>

"), + ("Dupuis <'tr/-:dupuis><#><$'@truc.baz.fr>", "

Dupuis <'tr/-:dupuis><#><$'@truc.baz.fr>

"), + ("Technical ", "

Technical <service/technical+2@open.com>

"), + ("Div nico ", "

Div nico <div-nico@open.com>

")] + for email in emails: + self.assertEqual(email[1], html_sanitize(email[0]), 'html_sanitize stripped emails of original html') + + def test_edi_source(self): html = html_sanitize(EDI_LIKE_HTML_SOURCE) self.assertIn('div style="font-family: \'Lucica Grande\', Ubuntu, Arial, Verdana, sans-serif; font-size: 12px; color: rgb(34, 34, 34); background-color: #FFF;', html, diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index f1bb5a7a7ff..c0dc03b051a 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -48,6 +48,11 @@ def html_sanitize(src): if not src: return src src = ustr(src, errors='replace') + + # html encode email tags + part = re.compile(r"(<\s*[^\s]+@[^\s]+\s*>)", re.IGNORECASE | re.DOTALL) + src = part.sub(lambda m: cgi.escape(m.group(1)), src) + # some corner cases make the parser crash (such as in test_mail) try: cleaner = clean.Cleaner(page_structure=True, style=False, safe_attrs_only=False, forms=False, kill_tags=tags_to_kill, remove_tags=tags_to_remove) From a4e7fa97f4056f9b62b40c4b96f4ff5c57a84acc Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Wed, 2 Jan 2013 10:00:40 +0100 Subject: [PATCH 2/4] [IMP] mail sanitize: add special email address for escape in the sanitizer bzr revid: chm@openerp.com-20130102090040-yh0vdv8b3mtwoebh --- openerp/tests/test_mail.py | 2 +- openerp/tools/mail.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/openerp/tests/test_mail.py b/openerp/tests/test_mail.py index c0ba042c198..426c980e762 100644 --- a/openerp/tests/test_mail.py +++ b/openerp/tests/test_mail.py @@ -230,7 +230,7 @@ class TestSanitizer(unittest2.TestCase): self.assertNotIn(attr, sanitized_html, 'html_sanitize did not remove enough unwanted attributes') emails =[("Charles ", "

Charles <charles.bidule@truc.fr>

"), - ("Dupuis <'tr/-:dupuis><#><$'@truc.baz.fr>", "

Dupuis <'tr/-:dupuis><#><$'@truc.baz.fr>

"), + ("Dupuis <'tr/-: ${dupuis><#><$'@truc.baz.fr>", "

Dupuis <'tr/-: ${dupuis><#><$'@truc.baz.fr>

"), ("Technical ", "

Technical <service/technical+2@open.com>

"), ("Div nico ", "

Div nico <div-nico@open.com>

")] for email in emails: diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index c0dc03b051a..01b6a7cacc3 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -50,7 +50,7 @@ def html_sanitize(src): src = ustr(src, errors='replace') # html encode email tags - part = re.compile(r"(<\s*[^\s]+@[^\s]+\s*>)", re.IGNORECASE | re.DOTALL) + part = re.compile(r"(<\s*([^\s]+|'([^']|(?:\\)\\(\\\\)*')+'|\"([^\"]|(?:\\)\\(\\\\)*\")+\")@[^\s]+\s*>)", re.IGNORECASE | re.DOTALL) src = part.sub(lambda m: cgi.escape(m.group(1)), src) # some corner cases make the parser crash (such as in test_mail) From 6a07b69889ea33f42c3e9b3328e0ad91bbf59b4f Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Wed, 2 Jan 2013 17:14:58 +0100 Subject: [PATCH 3/4] [IMP] html_sanitize: test with assertIn bzr revid: chm@openerp.com-20130102161458-4pvpvfb1shmt0sjy --- openerp/tests/test_mail.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/openerp/tests/test_mail.py b/openerp/tests/test_mail.py index 426c980e762..d7b3e786604 100644 --- a/openerp/tests/test_mail.py +++ b/openerp/tests/test_mail.py @@ -229,12 +229,12 @@ class TestSanitizer(unittest2.TestCase): for attr in ['javascript']: self.assertNotIn(attr, sanitized_html, 'html_sanitize did not remove enough unwanted attributes') - emails =[("Charles ", "

Charles <charles.bidule@truc.fr>

"), - ("Dupuis <'tr/-: ${dupuis><#><$'@truc.baz.fr>", "

Dupuis <'tr/-: ${dupuis><#><$'@truc.baz.fr>

"), - ("Technical ", "

Technical <service/technical+2@open.com>

"), - ("Div nico ", "

Div nico <div-nico@open.com>

")] + emails =[("Charles ", "Charles <charles.bidule@truc.fr>"), + ("Dupuis <'tr/-: ${dupuis><#><$'@truc.baz.fr>", "Dupuis <'tr/-: ${dupuis><#><$'@truc.baz.fr>"), + ("Technical ", "Technical <service/technical+2@open.com>"), + ("Div nico ", "Div nico <div-nico@open.com>")] for email in emails: - self.assertEqual(email[1], html_sanitize(email[0]), 'html_sanitize stripped emails of original html') + self.assertIn(email[1], html_sanitize(email[0]), 'html_sanitize stripped emails of original html') def test_edi_source(self): From 21c5425d896722a19e4fbdbc0ede64e1e6bd7762 Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Wed, 2 Jan 2013 17:25:44 +0100 Subject: [PATCH 4/4] [IMP] mail_sanitize: simplification of the regular expression bzr revid: chm@openerp.com-20130102162544-jfwdfqx2ruf0x1q2 --- openerp/tests/test_mail.py | 2 +- openerp/tools/mail.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/openerp/tests/test_mail.py b/openerp/tests/test_mail.py index d7b3e786604..ddb8fc4a195 100644 --- a/openerp/tests/test_mail.py +++ b/openerp/tests/test_mail.py @@ -230,7 +230,7 @@ class TestSanitizer(unittest2.TestCase): self.assertNotIn(attr, sanitized_html, 'html_sanitize did not remove enough unwanted attributes') emails =[("Charles ", "Charles <charles.bidule@truc.fr>"), - ("Dupuis <'tr/-: ${dupuis><#><$'@truc.baz.fr>", "Dupuis <'tr/-: ${dupuis><#><$'@truc.baz.fr>"), + ("Dupuis <'tr/-: ${dupuis#$'@truc.baz.fr>", "Dupuis <'tr/-: ${dupuis#$'@truc.baz.fr>"), ("Technical ", "Technical <service/technical+2@open.com>"), ("Div nico ", "Div nico <div-nico@open.com>")] for email in emails: diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index 01b6a7cacc3..7ca9dd75bac 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -50,7 +50,7 @@ def html_sanitize(src): src = ustr(src, errors='replace') # html encode email tags - part = re.compile(r"(<\s*([^\s]+|'([^']|(?:\\)\\(\\\\)*')+'|\"([^\"]|(?:\\)\\(\\\\)*\")+\")@[^\s]+\s*>)", re.IGNORECASE | re.DOTALL) + part = re.compile(r"(<[^<>]+@[^<>]+>)", re.IGNORECASE | re.DOTALL) src = part.sub(lambda m: cgi.escape(m.group(1)), src) # some corner cases make the parser crash (such as in test_mail)