[FIX] core: remove email escape logic from html_sanitize.

Related to #30326

Before #30326, when calling html_sanitize, some content may be escaped
when it shouldn't. A simple example was images with cid links containing @.
(a first fix for another use case was made in 8aff53733b)

We suspect that this escaping (added in 71a92f46e4)
was made to avoid loosing email with format '<email@domaine>' in html_sanitize
to escape them if html_sanitize is called on plain text.

Anyway, only html should be passed to html_sanitize, and therefore email of format
<email@domain> should already be escaped.

PR #30326 fixes the unwanted behaviour in 12.0 and this commit removes
this logic in master.

closes odoo/odoo#30815
This commit is contained in:
XavierDo
2019-02-07 08:53:45 +00:00
parent c875d02572
commit b8f2edd94c
2 changed files with 0 additions and 15 deletions
-10
View File
@@ -92,16 +92,6 @@ class TestSanitizer(unittest.TestCase):
for attr in ['javascript']:
self.assertNotIn(attr, sanitized_html, 'html_sanitize did not remove enough unwanted attributes')
def test_sanitize_escape_emails(self):
emails = [
"Charles <charles.bidule@truc.fr>",
"Dupuis <'tr/-: ${dupuis#$'@truc.baz.fr>",
"Technical <service/technical+2@open.com>",
"Div nico <div-nico@open.com>"
]
for email in emails:
self.assertIn(misc.html_escape(email), html_sanitize(email), 'html_sanitize stripped emails of original html')
def test_sanitize_unescape_emails(self):
not_emails = [
'<blockquote cite="mid:CAEJSRZvWvud8c6Qp=wfNG6O1+wK3i_jb33qVrF7XyrgPNjnyUA@mail.gmail.com" type="cite">cat</blockquote>',
-5
View File
@@ -176,11 +176,6 @@ def html_sanitize(src, silent=True, sanitize_tags=True, sanitize_attributes=Fals
logger = logging.getLogger(__name__ + '.html_sanitize')
# html encode email tags
part = re.compile(r"(<(([^a<>]|a[^<>\s])[^<>]*)@[^<>]+>)", re.IGNORECASE | re.DOTALL)
# remove results containing cite="mid:email_like@address" (ex: blockquote cite)
# cite_except = re.compile(r"^((?!cite[\s]*=['\"]).)*$", re.IGNORECASE)
src = part.sub(lambda m: (u'cite=' not in m.group(1) and u'alt=' not in m.group(1) and u'src=' not in m.group(1)) and misc.html_escape(m.group(1)) or m.group(1), src)
# html encode mako tags <% ... %> to decode them later and keep them alive, otherwise they are stripped by the cleaner
src = src.replace(u'<%', misc.html_escape(u'<%'))
src = src.replace(u'%>', misc.html_escape(u'%>'))