~ubuntu-branches/ubuntu/precise/trac/precise

#! /bin/sh /usr/share/dpatch/dpatch-run

## 17_SA32652.dpatch by Giuseppe Iuculano <giuseppe@iuculano.it>

##

## All lines beginning with `## DP:' are a description of the patch.

## DP: Backported patch to fix SA32652

 

@DPATCH@

diff -urNad trac-0.11.1~/trac/util/html.py trac-0.11.1/trac/util/html.py

--- trac-0.11.1~/trac/util/html.py      2008-08-07 03:00:20.000000000 +0200

+++ trac-0.11.1/trac/util/html.py       2008-11-16 18:22:50.000000000 +0100

@@ -14,10 +14,74 @@

 import re

 

 from genshi import Markup, escape, unescape

-from genshi.core import stripentities, striptags

+from genshi.core import stripentities, striptags, START, END

 from genshi.builder import Element, ElementFactory, Fragment

+from genshi.filters.html import HTMLSanitizer

 

-__all__ = ['escape', 'unescape', 'html', 'plaintext']

+__all__ = ['escape', 'unescape', 'html', 'plaintext', 'TracHTMLSanitizer']

+

+

+class TracHTMLSanitizer(HTMLSanitizer):

+

+    UNSAFE_CSS = ['position']

+

+    def __init__(self):

+        safe_attrs = HTMLSanitizer.SAFE_ATTRS | set(['style'])

+        super(TracHTMLSanitizer, self).__init__(safe_attrs=safe_attrs)

+

+    def sanitize_css(self, text):

+        decls = []

+        text = self._strip_css_comments(self._replace_unicode_escapes(text))

+        for decl in filter(None, text.split(';')):

+            decl = decl.strip()

+            if not decl:

+                continue

+            try:

+                prop, value = decl.split(':', 1)

+            except ValueError:

+                continue

+            if not self.is_safe_css(prop.strip().lower(), value.strip()):

+                continue

+            is_evil = False

+            if 'expression' in decl:

+                is_evil = True

+            for match in re.finditer(r'url\s*\(([^)]+)', decl):

+                if not self.is_safe_uri(match.group(1)):

+                    is_evil = True

+                    break

+            if not is_evil:

+                decls.append(decl.strip())

+        return decls

+

+    def __call__(self, stream):

+        """Remove input type="password" elements from the stream

+        """

+        suppress = False

+        for kind, data, pos in super(TracHTMLSanitizer, self).__call__(stream):

+            if kind is START:

+                tag, attrs = data

+                if (tag == 'input' and

+                    attrs.get('type', '').lower() == 'password'):

+                    suppress = True

+                else:

+                    yield kind, data, pos

+            elif kind is END:

+                if not suppress:

+                    yield kind, data, pos

+                suppress = False

+            else:

+                yield kind, data, pos

+

+    def is_safe_css(self, prop, value):

+        """Determine whether the given css property declaration is to be 

+        considered safe for inclusion in the output.

+        """

+        if prop in self.UNSAFE_CSS:

+            return False

+        # Negative margins can be used for phishing

+        elif prop.startswith('margin') and '-' in value:

+            return False

+        return True

 

 

 class Deuglifier(object):

diff -urNad trac-0.11.1~/trac/wiki/formatter.py trac-0.11.1/trac/wiki/formatter.py

--- trac-0.11.1~/trac/wiki/formatter.py 2008-08-07 03:00:20.000000000 +0200

+++ trac-0.11.1/trac/wiki/formatter.py  2008-11-16 18:22:50.000000000 +0100

@@ -26,7 +26,6 @@

 

 from genshi.builder import tag, Element

 from genshi.core import Stream, Markup, escape

-from genshi.filters import HTMLSanitizer

 from genshi.input import HTMLParser, ParseError

 from genshi.util import plaintext

 

@@ -38,6 +37,7 @@

 from trac.wiki.parser import WikiParser

 from trac.util.text import shorten_line, to_unicode, \

                            unicode_quote, unicode_quote_plus

+from trac.util.html import TracHTMLSanitizer

 from trac.util.translation import _

 

 __all__ = ['wiki_to_html', 'wiki_to_oneliner', 'wiki_to_outline',

@@ -86,8 +86,7 @@

                               'span': self._span_processor,

                               'Span': self._span_processor}

 

-        self._sanitizer = HTMLSanitizer(safe_attrs=HTMLSanitizer.SAFE_ATTRS |

-                                        set(['style']))

+        self._sanitizer = TracHTMLSanitizer()

         

         self.processor = builtin_processors.get(name)

         if not self.processor:

diff -urNad trac-0.11.1~/trac/wiki/parser.py trac-0.11.1/trac/wiki/parser.py

--- trac-0.11.1~/trac/wiki/parser.py    2008-08-07 03:00:20.000000000 +0200

+++ trac-0.11.1/trac/wiki/parser.py     2008-11-16 18:23:51.000000000 +0100

@@ -98,9 +98,10 @@

         #  * list

         r"(?P<list>^(?P<ldepth>\s+)(?:[-*]|\d+\.|[a-zA-Z]\.|[ivxIVX]{1,5}\.) )",

         # definition:: 

-        r"(?P<definition>^\s+((?:%s[^%s]*%s|%s.*?%s|[^%s%s:]|:[^:])+::)(?:\s+|$))"

+        r"(?P<definition>^\s+((?:%s[^%s]*%s|%s(?:%s{,2}[^%s])*?%s|[^%s%s:]|:[^:])+::)(?:\s+|$))"

         % (INLINE_TOKEN, INLINE_TOKEN, INLINE_TOKEN,

-           STARTBLOCK_TOKEN, ENDBLOCK_TOKEN, INLINE_TOKEN, STARTBLOCK[0]),

+           STARTBLOCK_TOKEN, ENDBLOCK[0], ENDBLOCK[0], ENDBLOCK_TOKEN,

+           INLINE_TOKEN, STARTBLOCK[0]),

         # (leading space)

         r"(?P<indent>^(?P<idepth>\s+)(?=\S))",

         # || table ||

diff -urNad trac-0.11.1~/trac/wiki/tests/wiki-tests.txt trac-0.11.1/trac/wiki/tests/wiki-tests.txt

--- trac-0.11.1~/trac/wiki/tests/wiki-tests.txt 2008-08-07 03:00:20.000000000 +0200

+++ trac-0.11.1/trac/wiki/tests/wiki-tests.txt  2008-11-16 18:23:51.000000000 +0100

@@ -1034,6 +1034,16 @@

 </blockquote>

 ------------------------------

 term::definition

+============================== Pathological definition list counter example with block quotes

+ {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}} {{{a}}}

+------------------------------

+<blockquote>

+<p>

+<tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt>

+</p>

+</blockquote>

+------------------------------

+<tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt> <tt>a</tt>

 ============================== Definition list + escaped definition list

  complex topic:: multiline

                  `not:: a dl`