Mercurial > p > roundup > code
view roundup/dist/command/build_doc.py @ 8356:63390dcfcfe9
bug: fix template use of structure with untrusted data
Looks like an xSS bug with an early version of the template that was
fixed in the code but never in the deployed tracker. It has been a
while since this particular construct has been in the classic template
which is the base for the tracker.
This has been fixed on the deployed tracker as well.
reported by 4bug of ChaMd5 Security Team H1 Group
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 08 Jul 2025 10:23:09 -0400 |
| parents | d2ca7b1bfc6b |
| children |
line wrap: on
line source
# # Copyright (C) 2009 Stefan Seefeld # All rights reserved. # For license terms see the file COPYING.txt. # import os, sys import os.path try: from setuptools.command.install import install as _build_py except ImportError: from distutils.command.build import build as _build_py # try/except clause orig_build = _build_py try: # would be nice to use setuptools.Command.spawn() as it # obeys the dry-run flag. from subprocess import run as spawn except ImportError: from distutils.spawn import spawn # try/except: in except for subprocess try: from distutils.spawn import find_executable # try/except: in try local find except ImportError: from roundup.dist.command import find_executable class build_doc(_build_py): """Defines the specific procedure to build roundup's documentation.""" description = "build documentation" def run(self): """Run this command, i.e. do the actual document generation.""" sphinx = find_executable('sphinx-build') if sphinx: sphinx = [sphinx] else: try: # try to find version installed with Python tools # tested with Sphinx 1.1.3 import sphinx as sp except ImportError: pass else: sphinx = [sys.executable, sp.__file__] if not sphinx: self.warn("could not find sphinx-build in PATH") self.warn("cannot build documentation") return doc_dir = os.path.join('share', 'doc', 'roundup', 'html') temp_dir = os.path.join(self.build_base, 'temp.doc') cmd = sphinx + ['-d', temp_dir, 'doc', doc_dir] spawn(cmd)
