From be5118c704bcabdc0abc7cbe3727e20aa171ab37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Wed, 26 Dec 2012 17:43:54 +0100 Subject: [PATCH] [DOC] Added some comments. Updated failure message. Added a logging message when not capable of parsing. bzr revid: tde@openerp.com-20121226164354-tjquf1zdyr90tl5e --- openerp/tests/test_mail.py | 1 + openerp/tools/mail.py | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/openerp/tests/test_mail.py b/openerp/tests/test_mail.py index 69f4b5f8bcc..50db556d234 100644 --- a/openerp/tests/test_mail.py +++ b/openerp/tests/test_mail.py @@ -179,6 +179,7 @@ class TestSanitizer(unittest2.TestCase): self.assertEqual(html, expected, 'html_sanitize is broken') def test_evil_malicious_code(self): + # taken from https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Tests cases = [ (""), # no quotes and semicolons (""), # UTF-8 Unicode encoding diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index bd84a7a3f48..e00d1fbda2e 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -40,7 +40,6 @@ _logger = logging.getLogger(__name__) # HTML Sanitizer #---------------------------------------------------------- -# FIXME: shouldn't this be a whitelist rather than a blacklist?! tags_to_kill = ["script", "head", "meta", "title", "link", "style", "frame", "iframe", "base", "object", "embed"] tags_to_remove = ['html', 'body', 'font'] @@ -50,12 +49,13 @@ def html_sanitize(src): return src src = ustr(src, errors='replace') - # some cases make the parser crash (such as SCRIPT/XSS in test_mail) + # some corner cases make the parser crash (such as in test_mail) try: cleaner = clean.Cleaner(page_structure=True, style=False, safe_attrs_only=False, forms=False, kill_tags=tags_to_kill, remove_tags=tags_to_remove) cleaned = cleaner.clean_html(src) except: - cleaned = 'Impossible to parse' + _logger.debug('Failed to parse %s' % (src)) + cleaned = '

Impossible to parse

' return cleaned