aniani/brutaldon
1
0
Fork 0
mirror of https://gitlab.com/brutaldon/brutaldon.git synced 2024-12-04 14:46:24 -05:00
Code

Fix unescaping of html in template filters.

Browse Source 
This was not a security bug, because it was done before passing code to
sanitize, but it was totally an annoying UI bug.
This commit is contained in:
Jason McBrayer 2018-06-06 15:21:00 -04:00
parent e05601db22
commit d0770dbbe1
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
brutaldon/templatetags/taglinks.py
View File

@ -2,9 +2,15 @@ from django import template
from bs4 import BeautifulSoup from bs4 import BeautifulSoup
from urllib import parse from urllib import parse
from django.urls import reverse from django.urls import reverse
from pdb import set_trace
register = template.Library() register = template.Library()
@register.filter
def pdb(element):
set_trace()
return element
@register.filter @register.filter
def relink_tags(value): def relink_tags(value):
'''Treat the text as html, and replace tag links with app-internal tag links '''Treat the text as html, and replace tag links with app-internal tag links
@ -18,7 +24,7 @@ def relink_tags(value):
soup = BeautifulSoup(value, 'html.parser') soup = BeautifulSoup(value, 'html.parser')
for link in soup.find_all('a', class_='hashtag'): for link in soup.find_all('a', class_='hashtag'):
link['href'] = reverse('tag', args=[link.span.string]) link['href'] = reverse('tag', args=[link.span.string])
return soup.decode(formatter=None) return soup.decode(formatter='html')
@register.filter @register.filter
def relink_mentions(value): def relink_mentions(value):
@ -39,7 +45,7 @@ def relink_mentions(value):
link['href'] = reverse('user', args=[user+'@'+instance]) link['href'] = reverse('user', args=[user+'@'+instance])
except: except:
continue continue
return soup.decode(formatter=None) return soup.decode(formatter='html')
@register.filter @register.filter
def relink_toot(value): def relink_toot(value):