From dc170d1a9a0749588cf94f30990cc9b245ef7e2b Mon Sep 17 00:00:00 2001
From: niv-openerp <nicolas.vanhoren@openerp.com>
Date: Mon, 13 Aug 2012 17:52:05 +0200
Subject: [PATCH] Added protection against javascript in <a>

bzr revid: nicolas.vanhoren@openerp.com-20120813155205-uohwb39ejn66bgmv
---
 openerp/tests/test_html_sanitize.py | 1 +
 openerp/tools/html_sanitize.py      | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/openerp/tests/test_html_sanitize.py b/openerp/tests/test_html_sanitize.py
index 906c78d1dcf..3efb4a43ca5 100755
--- a/openerp/tests/test_html_sanitize.py
+++ b/openerp/tests/test_html_sanitize.py
@@ -17,6 +17,7 @@ test11</font></div></div></div></blockquote><blockquote style="margin: 0 0 0 40p
 <blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><font color="#1f1f1f" face="monospace" size="2">
 test12</font></div><div><font color="#1f1f1f" face="monospace" size="2"><br></font></div></blockquote></blockquote>
 <font color="#1f1f1f" face="monospace" size="2"><a href="http://google.com">google</a></font>
+<a href="javascript:alert('malicious code')">test link</a>
 """
 
 class TestSanitizer(unittest.TestCase):
diff --git a/openerp/tools/html_sanitize.py b/openerp/tools/html_sanitize.py
index 2010459ca12..74d83a2c453 100644
--- a/openerp/tools/html_sanitize.py
+++ b/openerp/tools/html_sanitize.py
@@ -1,5 +1,6 @@
 
 from pyquery import PyQuery as pq
+import re
 
 def html_sanitize(x):
     root = pq("<div />")
@@ -11,8 +12,12 @@ def html_sanitize(x):
 to_remove = set(["script", "head", "meta", "title", "link", "img"])
 to_unwrap = set(["html", "body"])
 
+javascript_regex = re.compile("""^\s*javascript\s*\:.*$""")
 def handle_a(el, new):
-    new.set("href", el.get("href", "#"))
+    href = el.get("href", "#")
+    if javascript_regex.search(href):
+        href = "#"
+    new.set("href", href)
 special = {
     "a": handle_a,
 }