Mercurial > p > roundup > code
comparison roundup/cgi/templating.py @ 6098:72a281a55a17
Disable rst raw and include directives.
reStructuredText has some directives that can include files or pass
raw html to the output.
Create new property so user can enable raw or include directives if
desired. See: https://docutils.sourceforge.io/docs/howto/security.html
for details.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 20 Feb 2020 21:38:32 -0500 |
| parents | 90a1470edbea |
| children | 55c56ceacb8e |
comparison
equal
deleted
inserted
replaced
| 6097:90a1470edbea | 6098:72a281a55a17 |
|---|---|
| 1453 (?P<email>[-+=%/\w\.]+@[\w\.\-]+)| | 1453 (?P<email>[-+=%/\w\.]+@[\w\.\-]+)| |
| 1454 (?P<item>(?P<class>[A-Za-z_]+)(\s*)(?P<id>\d+)) | 1454 (?P<item>(?P<class>[A-Za-z_]+)(\s*)(?P<id>\d+)) |
| 1455 )''', re.X | re.I) | 1455 )''', re.X | re.I) |
| 1456 protocol_re = re.compile('^(ht|f)tp(s?)://', re.I) | 1456 protocol_re = re.compile('^(ht|f)tp(s?)://', re.I) |
| 1457 | 1457 |
| 1458 | 1458 # disable rst directives that have security implications |
| 1459 rst_defaults = {'file_insertion_enabled': 0, | |
| 1460 'raw_enabled': 0, | |
| 1461 '_disable_config': 1} | |
| 1459 | 1462 |
| 1460 def _hyper_repl(self, match): | 1463 def _hyper_repl(self, match): |
| 1461 if match.group('url'): | 1464 if match.group('url'): |
| 1462 return self._hyper_repl_url(match, '<a href="%s" rel="nofollow noopener">%s</a>%s') | 1465 return self._hyper_repl_url(match, '<a href="%s" rel="nofollow noopener">%s</a>%s') |
| 1463 elif match.group('email'): | 1466 elif match.group('email'): |
| 1617 if not ReStructuredText: | 1620 if not ReStructuredText: |
| 1618 return self.plain(escape=0, hyperlink=hyperlink) | 1621 return self.plain(escape=0, hyperlink=hyperlink) |
| 1619 s = self.plain(escape=0, hyperlink=0) | 1622 s = self.plain(escape=0, hyperlink=0) |
| 1620 if hyperlink: | 1623 if hyperlink: |
| 1621 s = self.hyper_re.sub(self._hyper_repl_rst, s) | 1624 s = self.hyper_re.sub(self._hyper_repl_rst, s) |
| 1622 return u2s(ReStructuredText(s, writer_name="html")["html_body"]) | 1625 return u2s(ReStructuredText(s, writer_name="html", |
| 1626 settings_overrides=self.rst_defaults)["html_body"]) | |
| 1623 | 1627 |
| 1624 def markdown(self, hyperlink=1): | 1628 def markdown(self, hyperlink=1): |
| 1625 """ Render the value of the property as markdown. | 1629 """ Render the value of the property as markdown. |
| 1626 | 1630 |
| 1627 This requires markdown2 or markdown to be installed separately. | 1631 This requires markdown2 or markdown to be installed separately. |