diff options
| author | Christophe Matthieu <chm@openerp.com> | 2012-12-31 16:44:51 +0100 |
|---|---|---|
| committer | Christophe Matthieu <chm@openerp.com> | 2012-12-31 16:44:51 +0100 |
| commit | 71a92f46e4e223a3bad0e27ececa2ece3c09f5d1 (patch) | |
| tree | b26d61fd3d933b53e17ab28745e81a46b09e0260 | |
| parent | de4ba1084a38ef64634b75c9349576411c40a829 (diff) | |
[FIX] tools: html_sanitize
bzr revid: chm@openerp.com-20121231154451-0guqjid92rfndghp
| -rw-r--r-- | openerp/tests/test_mail.py | 8 | ||||
| -rw-r--r-- | openerp/tools/mail.py | 5 |
2 files changed, 13 insertions, 0 deletions
diff --git a/openerp/tests/test_mail.py b/openerp/tests/test_mail.py index 50db556d234..c0ba042c198 100644 --- a/openerp/tests/test_mail.py +++ b/openerp/tests/test_mail.py @@ -229,6 +229,14 @@ class TestSanitizer(unittest2.TestCase): for attr in ['javascript']: self.assertNotIn(attr, sanitized_html, 'html_sanitize did not remove enough unwanted attributes') + emails =[("Charles <charles.bidule@truc.fr>", "<p>Charles <charles.bidule@truc.fr></p>"), + ("Dupuis <'tr/-:dupuis><#><$'@truc.baz.fr>", "<p>Dupuis <'tr/-:dupuis><#><$'@truc.baz.fr></p>"), + ("Technical <service/technical+2@open.com>", "<p>Technical <service/technical+2@open.com></p>"), + ("Div nico <div-nico@open.com>", "<p>Div nico <div-nico@open.com></p>")] + for email in emails: + self.assertEqual(email[1], html_sanitize(email[0]), 'html_sanitize stripped emails of original html') + + def test_edi_source(self): html = html_sanitize(EDI_LIKE_HTML_SOURCE) self.assertIn('div style="font-family: \'Lucica Grande\', Ubuntu, Arial, Verdana, sans-serif; font-size: 12px; color: rgb(34, 34, 34); background-color: #FFF;', html, diff --git a/openerp/tools/mail.py b/openerp/tools/mail.py index f1bb5a7a7ff..c0dc03b051a 100644 --- a/openerp/tools/mail.py +++ b/openerp/tools/mail.py @@ -48,6 +48,11 @@ def html_sanitize(src): if not src: return src src = ustr(src, errors='replace') + + # html encode email tags + part = re.compile(r"(<\s*[^\s]+@[^\s]+\s*>)", re.IGNORECASE | re.DOTALL) + src = part.sub(lambda m: cgi.escape(m.group(1)), src) + # some corner cases make the parser crash (such as <SCRIPT/XSS SRC=\"http://ha.ckers.org/xss.js\"></SCRIPT> in test_mail) try: cleaner = clean.Cleaner(page_structure=True, style=False, safe_attrs_only=False, forms=False, kill_tags=tags_to_kill, remove_tags=tags_to_remove) |