From a4e7fa97f4056f9b62b40c4b96f4ff5c57a84acc Mon Sep 17 00:00:00 2001 From: Christophe Matthieu Date: Wed, 2 Jan 2013 10:00:40 +0100 Subject: [PATCH] [IMP] mail sanitize: add special email address for escape in the sanitizer bzr revid: chm@openerp.com-20130102090040-yh0vdv8b3mtwoebh --- openerp/tests/test_mail.py | 2 +- openerp/tools/mail.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/openerp/tests/test_mail.py b/openerp/tests/test_mail.py index c0ba042c198..426c980e762 100644 --- a/openerp/tests/test_mail.py +++ b/openerp/tests/test_mail.py @@ -230,7 +230,7 @@ class TestSanitizer(unittest2.TestCase): self.assertNotIn(attr, sanitized_html, 'html_sanitize did not remove enough unwanted attributes') emails =[("Charles ", "

Charles <charles.bidule@truc.fr>

"), - ("Dupuis <'tr/-:dupuis><#><$'@truc.baz.fr>", "

Dupuis <'tr/-:dupuis><#><$'@truc.baz.fr>

"), + ("Dupuis <'tr/-: ${dupuis><#><$'@truc.baz.fr>", "

Dupuis <'tr/-: ${dupuis><#><$'@truc.baz.fr>

"), ("Technical ", "

Technical <service/technical+2@open.com>

"), ("Div nico ", "

Div nico <div-nico@open.com>

")] for email in emails: diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index c0dc03b051a..01b6a7cacc3 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -50,7 +50,7 @@ def html_sanitize(src): src = ustr(src, errors='replace') # html encode email tags - part = re.compile(r"(<\s*[^\s]+@[^\s]+\s*>)", re.IGNORECASE | re.DOTALL) + part = re.compile(r"(<\s*([^\s]+|'([^']|(?:\\)\\(\\\\)*')+'|\"([^\"]|(?:\\)\\(\\\\)*\")+\")@[^\s]+\s*>)", re.IGNORECASE | re.DOTALL) src = part.sub(lambda m: cgi.escape(m.group(1)), src) # some corner cases make the parser crash (such as in test_mail)