def test_unicode_url(self): # IPA extensions html = HTML(u'<div style="background-image:uʀʟ(javascript:alert())">' u'XSS</div>') self.assertEqual('<div>XSS</div>', unicode(html | TracHTMLSanitizer()))
def sanitize(self, html): sanitizer = TracHTMLSanitizer(safe_schemes=self.safe_schemes, safe_origins=self.safe_origins) return unicode(sanitizer.sanitize(html))
def sanitize(self, html): sanitizer = TracHTMLSanitizer(safe_schemes=self.safe_schemes, safe_origins=self.safe_origins) return unicode(HTML(html, encoding='utf-8') | sanitizer)
def _sanitizer(self): wikisys = WikiSystem(self.env) return TracHTMLSanitizer(safe_schemes=wikisys.safe_schemes, safe_origins=wikisys.safe_origins)
# you should have received as part of this distribution. The terms # are also available at http://trac.edgewall.com/license.html. # # Author: Christian Boos <*****@*****.**> # Mikael Relbe <*****@*****.**> import re import string from trac.util.html import Markup, html as tag from trac.util import arity from trac.util.compat import sorted from trac.util.html import TracHTMLSanitizer if hasattr(TracHTMLSanitizer, 'sanitize_attrs'): sanitizer = TracHTMLSanitizer() from trac.util.html import Element else: sanitizer = None from genshi.builder import Stream from trac.wiki.api import WikiSystem def prepare_regexp(d): syms = d.keys() syms.sort(lambda a, b: cmp(len(b), len(a))) return "|".join([ r'%s%s%s' % (r'\b' if re.match(r'\w', s[0]) else '', re.escape(s), r'\b' if re.match(r'\w', s[-1]) else '') for s in syms ])
def test_capital_expression(self): html = HTML('<div style="top:EXPRESSION(alert())">XSS</div>', encoding='utf-8') self.assertEqual('<div>XSS</div>', unicode(html | TracHTMLSanitizer()))
def test_capital_url_with_javascript(self): html = HTML( '<div style="background-image:URL(javascript:alert())">' 'XSS</div>', encoding='utf-8') self.assertEqual('<div>XSS</div>', unicode(html | TracHTMLSanitizer()))
def __init__(self): wiki = WikiSystem(self.env) if not wiki.render_unsafe_content: self.sanitizer = TracHTMLSanitizer(wiki.safe_schemes)
def __init__(self): self.log.info('version: %s - id: %s', __version__, str(__id__)) wiki = WikiSystem(self.env) if not wiki.render_unsafe_content: self.sanitizer = TracHTMLSanitizer(wiki.safe_schemes)
def sanitize(self, html): return unicode(HTML(html, encoding='utf-8') | TracHTMLSanitizer())
def sanitize(self, html): return unicode(TracHTMLSanitizer().sanitize(html))
def test_unicode_escapes(self): html = HTML( r'<div style="top:exp\72 ess\000069 on(alert())">' r'XSS</div>', encoding='utf-8') self.assertEqual('<div>XSS</div>', unicode(html | TracHTMLSanitizer()))