From 94357739bc3c531f8b6acde8fede17dc6d9d284f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Mon, 13 Jan 2014 09:57:01 +0100 Subject: [PATCH] [IMP] tools: mail: have a strict mode for html_sanitizer (not default) with options before website: without frames, with safe attributes only. We will have to find a way to use the strict mode when parsing incoming emails, but not when sending or storing openerp content. Currently the not strict mode is the default one, to avoid side-effects with the website. bzr revid: tde@openerp.com-20140113085701-f2bzu94cq1z3tl10 --- openerp/tools/mail.py | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index 55813bc9f01..3c4dbfdccdd 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -45,10 +45,14 @@ tags_to_remove = ['html', 'body', 'font'] # allow new semantic HTML5 tags allowed_tags = clean.defs.tags | frozenset('article section header footer hgroup nav aside figure main'.split()) -safe_attrs = clean.defs.safe_attrs | frozenset(['style']) +safe_attrs = clean.defs.safe_attrs | frozenset( + ['style', + 'data-oe-model', 'data-oe-id', 'data-oe-field', 'data-oe-type', 'data-oe-expression', 'data-oe-translate', 'data-oe-nodeid', + 'data-snippet-id', 'data-publish', 'data-id', 'data-res_id', 'data-member_id', 'data-view-id' + ]) -def html_sanitize(src, silent=True): +def html_sanitize(src, silent=True, strict=False): if not src: return src src = ustr(src, errors='replace') @@ -62,11 +66,18 @@ def html_sanitize(src, silent=True): kwargs = { 'page_structure': True, 'style': False, # do not remove style attributes - 'frames': False, # de not remove frames (embbed video in CMS blogs) 'forms': True, # remove form tags 'remove_unknown_tags': False, 'allow_tags': allowed_tags, } + if strict and etree.LXML_VERSION >= (3, 1, 0): # lxml < 3.1.0 does not allow to specify safe_attrs; however we always want to keep style + kwargs['safe_attrs_only'] = False + kwargs['safe_attrs_only'] = True + kwargs['safe_attrs'] = safe_attrs + else: + kwargs['frames'] = False, # do not remove frames (embbed video in CMS blogs) + kwargs['safe_attrs_only'] = False, # keep oe-data attributes + style + if etree.LXML_VERSION >= (2, 3, 1): # kill_tags attribute has been added in version 2.3.1 kwargs.update({ @@ -76,8 +87,6 @@ def html_sanitize(src, silent=True): else: kwargs['remove_tags'] = tags_to_kill + tags_to_remove - kwargs['safe_attrs_only'] = False - try: # some corner cases make the parser crash (such as in test_mail) cleaner = clean.Cleaner(**kwargs)