From e5e9e35c306613b647a5bec2d46dab1a120c02a4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9rome=20Maes?= Date: Fri, 20 Mar 2015 09:25:45 +0100 Subject: [PATCH] [FIX] im_chat : real sanitization of shortcode. Substitution can be HTML code (only for emoji and should respect the regex) or pure text (will be escaped to avoid XSS) at create and write. --- addons/im_chat/im_chat.py | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/addons/im_chat/im_chat.py b/addons/im_chat/im_chat.py index 689432e4157..07292c8b7f9 100644 --- a/addons/im_chat/im_chat.py +++ b/addons/im_chat/im_chat.py @@ -296,13 +296,26 @@ class im_chat_shortcode(osv.Model): 'description' : fields.char('Description'), } + def _sanitize_shorcode(self, substitution): + """ Sanitize the shortcode substitution : + - HTML substitution : only allow the img tag (smiley) + - escape other substitutions to avoid XSS + """ + is_img_tag = re.match(r'''^$''', substitution, re.M|re.I) + if is_img_tag: + return substitution + return cgi.escape(substitution) + def create(self, cr, uid, values, context=None): if values.get('substitution'): - values['substitution'] = tools.html_sanitize(values['substitution']).strip() - if not values.get('substitution'): - raise UserError(_("Substitution contains only forbidden characters. Please fill it with something else.")) + values['substitution'] = self._sanitize_shorcode(values['substitution']) return super(im_chat_shortcode, self).create(cr, uid, values, context=context) + def write(self, cr, uid, ids, values, context=None): + if values.get('substitution'): + values['substitution'] = self._sanitize_shorcode(values['substitution']) + return super(im_chat_shortcode, self).write(cr, uid, ids, values, context=context) + def replace_shortcode(self, cr, uid, message, context=None): ids = self.search(cr, uid, [], context=context) for shortcode in self.browse(cr, uid, ids, context=context):