diff --git a/openerp/tests/test_mail.py b/openerp/tests/test_mail.py index 6450c5ba780..ddb8fc4a195 100755 --- a/openerp/tests/test_mail.py +++ b/openerp/tests/test_mail.py @@ -23,7 +23,7 @@ ############################################################################## import unittest2 -from openerp.tools import html_sanitize, html_email_clean, append_content_to_html, plaintext2html, mute_logger +from openerp.tools import html_sanitize, html_email_clean, append_content_to_html, plaintext2html HTML_SOURCE = """ test1 @@ -178,7 +178,6 @@ class TestSanitizer(unittest2.TestCase): html = html_sanitize(content) self.assertEqual(html, expected, 'html_sanitize is broken') - @mute_logger('openerp.tools.mail') def test_evil_malicious_code(self): # taken from https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Tests cases = [ diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index c516cb7d643..b0605bf5c83 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -2,7 +2,7 @@ ############################################################################## # # OpenERP, Open Source Business Applications -# Copyright (C) 2012 OpenERP S.A. (). +# Copyright (C) 2012-2013 OpenERP S.A. (). # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as @@ -52,17 +52,19 @@ def html_sanitize(src): # html encode email tags part = re.compile(r"(<(([^a<>]|a[^<>\s])[^<>]*)@[^<>]+>)", re.IGNORECASE | re.DOTALL) src = part.sub(lambda m: cgi.escape(m.group(1)), src) - + # some corner cases make the parser crash (such as in test_mail) try: cleaner = clean.Cleaner(page_structure=True, style=False, safe_attrs_only=False, forms=False, kill_tags=tags_to_kill, remove_tags=tags_to_remove) cleaned = cleaner.clean_html(src) - except TypeError, e: + except TypeError: # lxml.clean version < 2.3.1 does not have a kill_tags attribute # to remove in 2014 - cleaner = clean.Cleaner(page_structure=True, style=False, safe_attrs_only=False, forms=False, remove_tags=tags_to_kill+tags_to_remove) + cleaner = clean.Cleaner(page_structure=True, style=False, safe_attrs_only=False, forms=False, remove_tags=tags_to_kill + tags_to_remove) cleaned = cleaner.clean_html(src) - except: + except Exception, e: + if isinstance(e, etree.ParserError) and 'empty' in str(e): + return "" _logger.warning('html_sanitize failed to parse %s' % (src)) cleaned = '

Impossible to parse

' return cleaned