pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[IMP] mail sanitize: add special email address for escape in the sanitizer

Browse Source 
bzr revid: chm@openerp.com-20130102090040-yh0vdv8b3mtwoebh
This commit is contained in:
Christophe Matthieu
2013-01-02 10:00:40 +01:00
parent 71a92f46e4
commit a4e7fa97f4
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openerp/tests/test_mail.py
+1 -1
View File
@@ -230,7 +230,7 @@ class TestSanitizer(unittest2.TestCase):
self.assertNotIn(attr, sanitized_html, 'html_sanitize did not remove enough unwanted attributes')
emails =[("Charles <charles.bidule@truc.fr>", "<p>Charles &lt;charles.bidule@truc.fr&gt;</p>"),
("Dupuis <'tr/-:dupuis><#><$'@truc.baz.fr>", "<p>Dupuis &lt;'tr/-:dupuis&gt;&lt;#&gt;&lt;$'@truc.baz.fr&gt;</p>"),
("Dupuis <'tr/-: ${dupuis><#><$'@truc.baz.fr>", "<p>Dupuis &lt;'tr/-: ${dupuis&gt;&lt;#&gt;&lt;$'@truc.baz.fr&gt;</p>"),
("Technical <service/technical+2@open.com>", "<p>Technical &lt;service/technical+2@open.com&gt;</p>"),
("Div nico <div-nico@open.com>", "<p>Div nico &lt;div-nico@open.com&gt;</p>")]
for email in emails:
openerp/tools/mail.py
+1 -1
View File
@@ -50,7 +50,7 @@ def html_sanitize(src):
src = ustr(src, errors='replace')
# html encode email tags
part = re.compile(r"(<\s*[^\s]+@[^\s]+\s*>)", re.IGNORECASE | re.DOTALL)
part = re.compile(r"(<\s*([^\s]+|'([^']|(?:\\)\\(\\\\)*')+'|\"([^\"]|(?:\\)\\(\\\\)*\")+\")@[^\s]+\s*>)", re.IGNORECASE | re.DOTALL)
src = part.sub(lambda m: cgi.escape(m.group(1)), src)
# some corner cases make the parser crash (such as <SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT> in test_mail)