From 5d0b496b29214838494b1d65bd04718113911450 Mon Sep 17 00:00:00 2001 From: David Lord Date: Thu, 9 May 2024 13:43:38 +0200 Subject: [PATCH] disallow invalid characters in keys to xmlattr filter --- Jinja2-2.10.1/jinja2/filters.py | 18 +++++++++++++----- Jinja2-2.10.1/tests/test_filters.py | 11 ++++++----- 2 files changed, 19 insertions(+), 10 deletions(-) diff --git a/Jinja2-2.10.1/jinja2/filters.py b/Jinja2-2.10.1/jinja2/filters.py index d473058..3e33f57 100644 --- a/Jinja2-2.10.1/jinja2/filters.py +++ b/Jinja2-2.10.1/jinja2/filters.py @@ -150,15 +150,23 @@ def do_lower(s): return soft_unicode(s).lower() -_space_re = re.compile(r"\s", flags=re.ASCII) +# Check for characters that would move the parser state from key to value. +# https://html.spec.whatwg.org/#attribute-name-state +_attr_key_re = re.compile(r"[\s/>=]", flags=re.ASCII) @evalcontextfilter def do_xmlattr(_eval_ctx, d, autospace=True): """Create an SGML/XML attribute string based on the items in a dict. - If any key contains a space, this fails with a ``ValueError``. Values that - are neither ``none`` nor ``undefined`` are automatically escaped. + **Values** that are neither ``none`` nor ``undefined`` are automatically + escaped, safely allowing untrusted user input. + + User input should not be used as **keys** to this filter. If any key + contains a space, ``/`` solidus, ``>`` greater-than sign, or ``=`` equals + sign, this fails with a ``ValueError``. Regardless of this, user input + should never be used as keys to this filter, or must be separately validated + first. .. sourcecode:: html+jinja @@ -184,8 +192,8 @@ def do_xmlattr(_eval_ctx, d, autospace=True): if value is None or isinstance(value, Undefined): continue - if _space_re.search(key) is not None: - raise ValueError(f"Spaces are not allowed in attributes: '{key}'") + if _attr_key_re.search(key) is not None: + raise ValueError(f"Invalid character in attribute name: {key!r}") items.append(f'{escape(key)}="{escape(value)}"') diff --git a/Jinja2-2.10.1/tests/test_filters.py b/Jinja2-2.10.1/tests/test_filters.py index 911d10a..153356d 100644 --- a/Jinja2-2.10.1/tests/test_filters.py +++ b/Jinja2-2.10.1/tests/test_filters.py @@ -389,11 +389,12 @@ class TestFilter(object): assert 'bar="23"' in out assert 'blub:blub="<?>"' in out - def test_xmlattr_key_with_spaces(self, env): - with pytest.raises(ValueError, match="Spaces are not allowed"): - env.from_string( - "{{ {'src=1 onerror=alert(1)': 'my_class'}|xmlattr }}" - ).render() + @pytest.mark.parametrize("sep", ("\t", "\n", "\f", " ", "/", ">", "=")) + def test_xmlattr_key_invalid(self, env: Environment, sep: str) -> None: + with pytest.raises(ValueError, match="Invalid character"): + env.from_string("{{ {key: 'my_class'}|xmlattr }}").render( + key=f"class{sep}onclick=alert(1)" + ) def test_sort1(self, env): tmpl = env.from_string( -- 2.45.0