Mercurial > p > roundup > code
diff test/test_templating.py @ 6098:72a281a55a17
Disable rst raw and include directives.
reStructuredText has some directives that can include files or pass
raw html to the output.
Create new property so user can enable raw or include directives if
desired. See: https://docutils.sourceforge.io/docs/howto/security.html
for details.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 20 Feb 2020 21:38:32 -0500 |
| parents | 90a1470edbea |
| children | 55c56ceacb8e |
line wrap: on
line diff
--- a/test/test_templating.py Thu Feb 20 19:30:26 2020 +0000 +++ b/test/test_templating.py Thu Feb 20 21:38:32 2020 -0500 @@ -264,8 +264,41 @@ def test_string_rst(self): p = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'A string with cmeerw@example.com *embedded* \u00df')) + + # test case to make sure include directive is disabled + q = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'\n\n.. include:: XyZrMt.html\n\n<badtag>\n\n')) + q_result=u'''<div class="document"> +<div class="system-message"> +<p class="system-message-title">System Message: WARNING/2 (<tt class="docutils"><string></tt>, line 3)</p> +<p>"include" directive disabled.</p> +<pre class="literal-block"> +.. include:: XyZrMt.html + +</pre> +</div> +<p><badtag></p> +</div> +''' + + # test case to make sure raw directive is disabled + r = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'\n\n.. raw:: html\n\n <badtag>\n\n')) + r_result='''<div class="document"> +<div class="system-message"> +<p class="system-message-title">System Message: WARNING/2 (<tt class="docutils"><string></tt>, line 3)</p> +<p>"raw" directive disabled.</p> +<pre class="literal-block"> +.. raw:: html + + <badtag> + +</pre> +</div> +</div> +''' if ReStructuredText: self.assertEqual(p.rst(), u2s(u'<div class="document">\n<p>A string with <a class="reference external" href="mailto:cmeerw@example.com">cmeerw@example.com</a> <em>embedded</em> \u00df</p>\n</div>\n')) + self.assertEqual(q.rst(), u2s(q_result)) + self.assertEqual(r.rst(), u2s(r_result)) else: self.assertEqual(p.rst(), u2s(u'A string with <a href="mailto:cmeerw@example.com">cmeerw@example.com</a> *embedded* \u00df'))