def test_unicode_url(self):
# IPA extensions
html = HTML(u'<div style="background-image:uʀʟ(javascript:alert())">'
u'XSS</div>')
self.assertEqual('<div>XSS</div>', unicode(html | TracHTMLSanitizer()))
def sanitize(self, html):
sanitizer = TracHTMLSanitizer(safe_schemes=self.safe_schemes,
safe_origins=self.safe_origins)
return unicode(sanitizer.sanitize(html))
def sanitize(self, html):
sanitizer = TracHTMLSanitizer(safe_schemes=self.safe_schemes,
safe_origins=self.safe_origins)
return unicode(HTML(html, encoding='utf-8') | sanitizer)
def _sanitizer(self):
wikisys = WikiSystem(self.env)
return TracHTMLSanitizer(safe_schemes=wikisys.safe_schemes,
safe_origins=wikisys.safe_origins)
# you should have received as part of this distribution. The terms
# are also available at http://trac.edgewall.com/license.html.
#
# Author: Christian Boos <*****@*****.**>
# Mikael Relbe <*****@*****.**>
import re
import string
from trac.util.html import Markup, html as tag
from trac.util import arity
from trac.util.compat import sorted
from trac.util.html import TracHTMLSanitizer
if hasattr(TracHTMLSanitizer, 'sanitize_attrs'):
sanitizer = TracHTMLSanitizer()
from trac.util.html import Element
else:
sanitizer = None
from genshi.builder import Stream
from trac.wiki.api import WikiSystem
def prepare_regexp(d):
syms = d.keys()
syms.sort(lambda a, b: cmp(len(b), len(a)))
return "|".join([
r'%s%s%s' % (r'\b' if re.match(r'\w', s[0]) else '', re.escape(s),
r'\b' if re.match(r'\w', s[-1]) else '') for s in syms
])
def test_capital_expression(self):
html = HTML('<div style="top:EXPRESSION(alert())">XSS</div>',
encoding='utf-8')
self.assertEqual('<div>XSS</div>', unicode(html | TracHTMLSanitizer()))
def test_capital_url_with_javascript(self):
html = HTML(
'<div style="background-image:URL(javascript:alert())">'
'XSS</div>',
encoding='utf-8')
self.assertEqual('<div>XSS</div>', unicode(html | TracHTMLSanitizer()))
def __init__(self):
wiki = WikiSystem(self.env)
if not wiki.render_unsafe_content:
self.sanitizer = TracHTMLSanitizer(wiki.safe_schemes)
def __init__(self):
self.log.info('version: %s - id: %s', __version__, str(__id__))
wiki = WikiSystem(self.env)
if not wiki.render_unsafe_content:
self.sanitizer = TracHTMLSanitizer(wiki.safe_schemes)
def sanitize(self, html):
return unicode(HTML(html, encoding='utf-8') | TracHTMLSanitizer())
def sanitize(self, html):
return unicode(TracHTMLSanitizer().sanitize(html))
def test_unicode_escapes(self):
html = HTML(
r'<div style="top:exp\72 ess\000069 on(alert())">'
r'XSS</div>',
encoding='utf-8')
self.assertEqual('<div>XSS</div>', unicode(html | TracHTMLSanitizer()))