pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[IMP] tools: mail: have a strict mode for html_sanitizer (not default) with

Browse Source 
options before website: without frames, with safe attributes only.
We will have to find a way to use the strict mode when parsing incoming
emails, but not when sending or storing openerp content.

Currently the not strict mode is the default one, to avoid side-effects with
the website.

bzr revid: tde@openerp.com-20140113085701-f2bzu94cq1z3tl10
This commit is contained in:
Thibault Delavallée
2014-01-13 09:57:01 +01:00
parent bad16022e8
commit 94357739bc
1 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openerp/tools/mail.py
+14 -5
View File
@@ -45,10 +45,14 @@ tags_to_remove = ['html', 'body', 'font']
# allow new semantic HTML5 tags
allowed_tags = clean.defs.tags | frozenset('article section header footer hgroup nav aside figure main'.split())
safe_attrs = clean.defs.safe_attrs | frozenset(['style'])
safe_attrs = clean.defs.safe_attrs | frozenset(
['style',
'data-oe-model', 'data-oe-id', 'data-oe-field', 'data-oe-type', 'data-oe-expression', 'data-oe-translate', 'data-oe-nodeid',
'data-snippet-id', 'data-publish', 'data-id', 'data-res_id', 'data-member_id', 'data-view-id'
])
def html_sanitize(src, silent=True):
def html_sanitize(src, silent=True, strict=False):
if not src:
return src
src = ustr(src, errors='replace')
@@ -62,11 +66,18 @@ def html_sanitize(src, silent=True):
kwargs = {
'page_structure': True,
'style': False, # do not remove style attributes
'frames': False, # de not remove frames (embbed video in CMS blogs)
'forms': True, # remove form tags
'remove_unknown_tags': False,
'allow_tags': allowed_tags,
}
if strict and etree.LXML_VERSION >= (3, 1, 0): # lxml < 3.1.0 does not allow to specify safe_attrs; however we always want to keep style
kwargs['safe_attrs_only'] = False
kwargs['safe_attrs_only'] = True
kwargs['safe_attrs'] = safe_attrs
else:
kwargs['frames'] = False, # do not remove frames (embbed video in CMS blogs)
kwargs['safe_attrs_only'] = False, # keep oe-data attributes + style
if etree.LXML_VERSION >= (2, 3, 1):
# kill_tags attribute has been added in version 2.3.1
kwargs.update({
@@ -76,8 +87,6 @@ def html_sanitize(src, silent=True):
else:
kwargs['remove_tags'] = tags_to_kill + tags_to_remove
kwargs['safe_attrs_only'] = False
try:
# some corner cases make the parser crash (such as <SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT> in test_mail)
cleaner = clean.Cleaner(**kwargs)