Mercurial > kallithea
changeset 7543:c9159e6fda04
cleanup: remove unnecessary (and potentially problematic) use of 'literal'
webhelpers.html.literal (kallithea.lib.helpers.literal) is only needed when
the passed string may contain HTML that needs to be interpreted literally.
It is unnecessary for plain strings.
Incorrect usage of literal can lead to XSS issues, via a malicious user
controlling data which will be rendered in other users' browsers. The data
could either be stored previously in the system or be part of a forged URL
the victim clicks on.
For example, when a user browses to a forged URL where a repository
changeset or branch name contains a javascript snippet, the snippet
was executed when printed on the page using 'literal'.
Remaining uses of 'literal' have been reviewed with no apparent problems
found.
Reported by Bob Hogg <wombat@rwhogg.site> (thanks!).
| author | Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> |
|---|---|
| date | Sat, 26 Jan 2019 20:00:14 +0100 |
| parents | 42a150500c25 |
| children | 2ac4499b25eb |
| files | kallithea/controllers/changelog.py kallithea/controllers/pullrequests.py kallithea/lib/auth.py kallithea/lib/base.py kallithea/templates/admin/settings/settings_system_update.html kallithea/templates/base/default_perms_box.html |
| diffstat | 6 files changed, 11 insertions(+), 13 deletions(-) [+] |
line wrap: on
line diff
--- a/kallithea/controllers/changelog.py Wed Feb 27 02:29:34 2019 +0100 +++ b/kallithea/controllers/changelog.py Sat Jan 26 20:00:14 2019 +0100 @@ -64,8 +64,7 @@ try: return c.db_repo_scm_instance.get_changeset(rev) except EmptyRepositoryError as e: - h.flash(h.literal(_('There are no changesets yet')), - category='error') + h.flash(_('There are no changesets yet'), category='error') except RepositoryError as e: log.error(traceback.format_exc()) h.flash(safe_str(e), category='error')
--- a/kallithea/controllers/pullrequests.py Wed Feb 27 02:29:34 2019 +0100 +++ b/kallithea/controllers/pullrequests.py Sat Jan 26 20:00:14 2019 +0100 @@ -249,7 +249,7 @@ try: org_scm_instance.get_changeset() except EmptyRepositoryError as e: - h.flash(h.literal(_('There are no changesets yet')), + h.flash(_('There are no changesets yet'), category='warning') raise HTTPFound(location=url('summary_home', repo_name=org_repo.repo_name))
--- a/kallithea/lib/auth.py Wed Feb 27 02:29:34 2019 +0100 +++ b/kallithea/lib/auth.py Sat Jan 26 20:00:14 2019 +0100 @@ -734,7 +734,7 @@ The optional message will be shown in a flash message.""" from kallithea.lib import helpers as h if message: - h.flash(h.literal(message), category='warning') + h.flash(message, category='warning') p = request.path_qs log.debug('Redirecting to login page, origin: %s', p) return HTTPFound(location=url('login_home', came_from=p))
--- a/kallithea/lib/base.py Wed Feb 27 02:29:34 2019 +0100 +++ b/kallithea/lib/base.py Sat Jan 26 20:00:14 2019 +0100 @@ -580,7 +580,7 @@ log.error('%s this repository is present in database but it ' 'cannot be created as an scm instance', c.repo_name) from kallithea.lib import helpers as h - h.flash(h.literal(_('Repository not found in the filesystem')), + h.flash(_('Repository not found in the filesystem'), category='error') raise webob.exc.HTTPNotFound() @@ -602,12 +602,11 @@ except EmptyRepositoryError as e: if returnempty: return repo.scm_instance.EMPTY_CHANGESET - h.flash(h.literal(_('There are no changesets yet')), - category='error') + h.flash(_('There are no changesets yet'), category='error') raise webob.exc.HTTPNotFound() except ChangesetDoesNotExistError as e: - h.flash(h.literal(_('Changeset for %s %s not found in %s') % - (ref_type, ref_name, repo.repo_name)), + h.flash(_('Changeset for %s %s not found in %s') % + (ref_type, ref_name, repo.repo_name), category='error') raise webob.exc.HTTPNotFound() except RepositoryError as e:
--- a/kallithea/templates/admin/settings/settings_system_update.html Wed Feb 27 02:29:34 2019 +0100 +++ b/kallithea/templates/admin/settings/settings_system_update.html Sat Jan 26 20:00:14 2019 +0100 @@ -6,7 +6,7 @@ %if c.should_upgrade: A <b>new version</b> is available: %if c.latest_data.get('title'): - <b>${h.literal(c.latest_data['title'])}</b> + <b>${c.latest_data['title']}</b> %else: <b>${c.latest_ver}</b> %endif
--- a/kallithea/templates/base/default_perms_box.html Wed Feb 27 02:29:34 2019 +0100 +++ b/kallithea/templates/base/default_perms_box.html Sat Jan 26 20:00:14 2019 +0100 @@ -24,7 +24,7 @@ <div> ${h.checkbox('create_repo_perm',value=True)} <span class="help-block"> - ${h.literal(_('Select this option to allow repository creation for this user'))} + ${_('Select this option to allow repository creation for this user')} </span> </div> </div> @@ -34,7 +34,7 @@ <div> ${h.checkbox('create_user_group_perm',value=True)} <span class="help-block"> - ${h.literal(_('Select this option to allow user group creation for this user'))} + ${_('Select this option to allow user group creation for this user')} </span> </div> </div> @@ -44,7 +44,7 @@ <div> ${h.checkbox('fork_repo_perm',value=True)} <span class="help-block"> - ${h.literal(_('Select this option to allow repository forking for this user'))} + ${_('Select this option to allow repository forking for this user')} </span> </div> </div>