Exemplos de escape em Python

Exemplo n.º 1

Arquivo: security.py Projeto: fanzhidongyzby/ambari

    def test_markup_operations(self):
        # adding two strings should escape the unsafe one
        unsafe = '<script type="application/x-some-script">alert("foo");</script>'
        safe = Markup("<em>username</em>")
        assert unsafe + safe == unicode(escape(unsafe)) + unicode(safe)

        # string interpolations are safe to use too
        assert Markup("<em>%s</em>") % "<bad user>" == "<em>&lt;bad user&gt;</em>"
        assert Markup("<em>%(username)s</em>") % {"username": "******"} == "<em>&lt;bad user&gt;</em>"

        # an escaped object is markup too
        assert type(Markup("foo") + "bar") is Markup

        # and it implements __html__ by returning itself
        x = Markup("foo")
        assert x.__html__() is x

        # it also knows how to treat __html__ objects
        class Foo(object):
            def __html__(self):
                return "<em>awesome</em>"

            def __unicode__(self):
                return "awesome"

        assert Markup(Foo()) == "<em>awesome</em>"
        assert Markup("<strong>%s</strong>") % Foo() == "<strong><em>awesome</em></strong>"

        # escaping and unescaping
        assert escape("\"<>&'") == "&#34;&lt;&gt;&amp;&#39;"
        assert Markup("<em>Foo &amp; Bar</em>").striptags() == "Foo & Bar"
        assert Markup("&lt;test&gt;").unescape() == "<test>"

Exemplo n.º 2

 def test_template_data(self):
     env = Environment(autoescape=True)
     t = env.from_string('{% macro say_hello(name) %}'
                         '<p>Hello {{ name }}!</p>{% endmacro %}'
                         '{{ say_hello("<blink>foo</blink>") }}')
     escaped_out = '<p>Hello &lt;blink&gt;foo&lt;/blink&gt;!</p>'
     assert t.render() == escaped_out
     assert unicode(t.module) == escaped_out
     assert escape(t.module) == escaped_out
     assert t.module.say_hello('<blink>foo</blink>') == escaped_out
     assert escape(t.module.say_hello('<blink>foo</blink>')) == escaped_out

Exemplo n.º 3

Arquivo: security.py Projeto: fanzhidongyzby/ambari

 def test_template_data(self):
     env = Environment(autoescape=True)
     t = env.from_string(
         "{% macro say_hello(name) %}"
         "<p>Hello {{ name }}!</p>{% endmacro %}"
         '{{ say_hello("<blink>foo</blink>") }}'
     )
     escaped_out = "<p>Hello &lt;blink&gt;foo&lt;/blink&gt;!</p>"
     assert t.render() == escaped_out
     assert unicode(t.module) == escaped_out
     assert escape(t.module) == escaped_out
     assert t.module.say_hello("<blink>foo</blink>") == escaped_out
     assert escape(t.module.say_hello("<blink>foo</blink>")) == escaped_out

Exemplo n.º 4

    def test_markup_operations(self):
        # adding two strings should escape the unsafe one
        unsafe = '<script type="application/x-some-script">alert("foo");</script>'
        safe = Markup('<em>username</em>')
        assert unsafe + safe == unicode(escape(unsafe)) + unicode(safe)

        # string interpolations are safe to use too
        assert Markup('<em>%s</em>') % '<bad user>' == \
               '<em>&lt;bad user&gt;</em>'
        assert Markup('<em>%(username)s</em>') % {
            'username': '******'
        } == '<em>&lt;bad user&gt;</em>'

        # an escaped object is markup too
        assert type(Markup('foo') + 'bar') is Markup

        # and it implements __html__ by returning itself
        x = Markup("foo")
        assert x.__html__() is x

        # it also knows how to treat __html__ objects
        class Foo(object):
            def __html__(self):
                return '<em>awesome</em>'

            def __unicode__(self):
                return 'awesome'

        assert Markup(Foo()) == '<em>awesome</em>'
        assert Markup('<strong>%s</strong>') % Foo() == \
               '<strong><em>awesome</em></strong>'

        # escaping and unescaping
        assert escape('"<>&\'') == '&#34;&lt;&gt;&amp;&#39;'
        assert Markup("<em>Foo &amp; Bar</em>").striptags() == "Foo & Bar"
        assert Markup("&lt;test&gt;").unescape() == "<test>"