[FIX] core: remove email escape logic from html_sanitize.
Related to #30326 Before #30326, when calling html_sanitize, some content may be escaped when it shouldn't. A simple example was images with cid links containing @. (a first fix for another use case was made in8aff53733b) We suspect that this escaping (added in71a92f46e4) was made to avoid loosing email with format '<email@domaine>' in html_sanitize to escape them if html_sanitize is called on plain text. Anyway, only html should be passed to html_sanitize, and therefore email of format <email@domain> should already be escaped. PR #30326 fixes the unwanted behaviour in 12.0 and this commit removes this logic in master. closes odoo/odoo#30815
This commit is contained in:
@@ -92,16 +92,6 @@ class TestSanitizer(unittest.TestCase):
|
||||
for attr in ['javascript']:
|
||||
self.assertNotIn(attr, sanitized_html, 'html_sanitize did not remove enough unwanted attributes')
|
||||
|
||||
def test_sanitize_escape_emails(self):
|
||||
emails = [
|
||||
"Charles <charles.bidule@truc.fr>",
|
||||
"Dupuis <'tr/-: ${dupuis#$'@truc.baz.fr>",
|
||||
"Technical <service/technical+2@open.com>",
|
||||
"Div nico <div-nico@open.com>"
|
||||
]
|
||||
for email in emails:
|
||||
self.assertIn(misc.html_escape(email), html_sanitize(email), 'html_sanitize stripped emails of original html')
|
||||
|
||||
def test_sanitize_unescape_emails(self):
|
||||
not_emails = [
|
||||
'<blockquote cite="mid:CAEJSRZvWvud8c6Qp=wfNG6O1+wK3i_jb33qVrF7XyrgPNjnyUA@mail.gmail.com" type="cite">cat</blockquote>',
|
||||
|
||||
@@ -176,11 +176,6 @@ def html_sanitize(src, silent=True, sanitize_tags=True, sanitize_attributes=Fals
|
||||
|
||||
logger = logging.getLogger(__name__ + '.html_sanitize')
|
||||
|
||||
# html encode email tags
|
||||
part = re.compile(r"(<(([^a<>]|a[^<>\s])[^<>]*)@[^<>]+>)", re.IGNORECASE | re.DOTALL)
|
||||
# remove results containing cite="mid:email_like@address" (ex: blockquote cite)
|
||||
# cite_except = re.compile(r"^((?!cite[\s]*=['\"]).)*$", re.IGNORECASE)
|
||||
src = part.sub(lambda m: (u'cite=' not in m.group(1) and u'alt=' not in m.group(1) and u'src=' not in m.group(1)) and misc.html_escape(m.group(1)) or m.group(1), src)
|
||||
# html encode mako tags <% ... %> to decode them later and keep them alive, otherwise they are stripped by the cleaner
|
||||
src = src.replace(u'<%', misc.html_escape(u'<%'))
|
||||
src = src.replace(u'%>', misc.html_escape(u'%>'))
|
||||
|
||||
Reference in New Issue
Block a user