Mercurial > p > roundup > code
view roundup/dist/command/build.py @ 8356:63390dcfcfe9
bug: fix template use of structure with untrusted data
Looks like an xSS bug with an early version of the template that was
fixed in the code but never in the deployed tracker. It has been a
while since this particular construct has been in the classic template
which is the base for the tracker.
This has been fixed on the deployed tracker as well.
reported by 4bug of ChaMd5 Security Team H1 Group
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 08 Jul 2025 10:23:09 -0400 |
| parents | 1acdc651133b |
| children | fed0f839c260 |
line wrap: on
line source
# # Copyright (C) 2009 Stefan Seefeld # All rights reserved. # For license terms see the file COPYING.txt. # from __future__ import print_function from roundup import msgfmt try: from setuptool.command.install import install as base except ImportError: from distutils.command.build import build as base import os from glob import glob def list_message_files(suffix=".po"): """Return list of all found message files and their intallation paths""" _files = glob("locale/*" + suffix) _list = [] for _file in _files: # basename (without extension) is a locale name _locale = os.path.splitext(os.path.basename(_file))[0] _list.append((_file, os.path.join( "share", "locale", _locale, "LC_MESSAGES", "roundup.mo"))) return _list def check_manifest(): """Check that the files listed in the MANIFEST are present when the source is unpacked. """ manifest_file = 'roundup.egg-info/SOURCES.txt' try: f=open(manifest_file) except: print('\n*** SOURCE WARNING: The MANIFEST file "%s" is missing!' % manifest_file) return try: manifest = [l.strip() for l in f.readlines()] finally: f.close() err = set([line for line in manifest if not os.path.exists(line)]) # ignore auto-generated files err = err - set(['roundup-admin', 'roundup-demo', 'roundup-gettext', 'roundup-mailgw', 'roundup-server', 'roundup-xmlrpc-server']) if err: n = len(manifest) print('\n*** SOURCE WARNING: There are files missing (%d/%d found)!'%( n-len(err), n)) print('Missing:', '\nMissing: '.join(err)) def build_message_files(command): """For each locale/*.po, build .mo file in target locale directory""" for (_src, _dst) in list_message_files(): _build_dst = os.path.join("build", _dst) command.mkpath(os.path.dirname(_build_dst)) command.announce("Compiling %s -> %s" % (_src, _build_dst)) mo = msgfmt.Msgfmt(_src).get() open(_build_dst, 'wb').write(mo) class build(base): def run(self): check_manifest() build_message_files(self) base.run(self)
