78 lines
3.1 KiB
Diff
78 lines
3.1 KiB
Diff
From 5d0b496b29214838494b1d65bd04718113911450 Mon Sep 17 00:00:00 2001
|
|
From: David Lord <davidism@gmail.com>
|
|
Date: Thu, 9 May 2024 13:43:38 +0200
|
|
Subject: [PATCH] disallow invalid characters in keys to xmlattr filter
|
|
|
|
---
|
|
Jinja2-2.10.1/jinja2/filters.py | 18 +++++++++++++-----
|
|
Jinja2-2.10.1/tests/test_filters.py | 11 ++++++-----
|
|
2 files changed, 19 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/Jinja2-2.10.1/jinja2/filters.py b/Jinja2-2.10.1/jinja2/filters.py
|
|
index d473058..3e33f57 100644
|
|
--- a/Jinja2-2.10.1/jinja2/filters.py
|
|
+++ b/Jinja2-2.10.1/jinja2/filters.py
|
|
@@ -150,15 +150,23 @@ def do_lower(s):
|
|
return soft_unicode(s).lower()
|
|
|
|
|
|
-_space_re = re.compile(r"\s", flags=re.ASCII)
|
|
+# Check for characters that would move the parser state from key to value.
|
|
+# https://html.spec.whatwg.org/#attribute-name-state
|
|
+_attr_key_re = re.compile(r"[\s/>=]", flags=re.ASCII)
|
|
|
|
|
|
@evalcontextfilter
|
|
def do_xmlattr(_eval_ctx, d, autospace=True):
|
|
"""Create an SGML/XML attribute string based on the items in a dict.
|
|
|
|
- If any key contains a space, this fails with a ``ValueError``. Values that
|
|
- are neither ``none`` nor ``undefined`` are automatically escaped.
|
|
+ **Values** that are neither ``none`` nor ``undefined`` are automatically
|
|
+ escaped, safely allowing untrusted user input.
|
|
+
|
|
+ User input should not be used as **keys** to this filter. If any key
|
|
+ contains a space, ``/`` solidus, ``>`` greater-than sign, or ``=`` equals
|
|
+ sign, this fails with a ``ValueError``. Regardless of this, user input
|
|
+ should never be used as keys to this filter, or must be separately validated
|
|
+ first.
|
|
|
|
.. sourcecode:: html+jinja
|
|
|
|
@@ -184,8 +192,8 @@ def do_xmlattr(_eval_ctx, d, autospace=True):
|
|
if value is None or isinstance(value, Undefined):
|
|
continue
|
|
|
|
- if _space_re.search(key) is not None:
|
|
- raise ValueError(f"Spaces are not allowed in attributes: '{key}'")
|
|
+ if _attr_key_re.search(key) is not None:
|
|
+ raise ValueError(f"Invalid character in attribute name: {key!r}")
|
|
|
|
items.append(f'{escape(key)}="{escape(value)}"')
|
|
|
|
diff --git a/Jinja2-2.10.1/tests/test_filters.py b/Jinja2-2.10.1/tests/test_filters.py
|
|
index 911d10a..153356d 100644
|
|
--- a/Jinja2-2.10.1/tests/test_filters.py
|
|
+++ b/Jinja2-2.10.1/tests/test_filters.py
|
|
@@ -389,11 +389,12 @@ class TestFilter(object):
|
|
assert 'bar="23"' in out
|
|
assert 'blub:blub="<?>"' in out
|
|
|
|
- def test_xmlattr_key_with_spaces(self, env):
|
|
- with pytest.raises(ValueError, match="Spaces are not allowed"):
|
|
- env.from_string(
|
|
- "{{ {'src=1 onerror=alert(1)': 'my_class'}|xmlattr }}"
|
|
- ).render()
|
|
+ @pytest.mark.parametrize("sep", ("\t", "\n", "\f", " ", "/", ">", "="))
|
|
+ def test_xmlattr_key_invalid(self, env: Environment, sep: str) -> None:
|
|
+ with pytest.raises(ValueError, match="Invalid character"):
|
|
+ env.from_string("{{ {key: 'my_class'}|xmlattr }}").render(
|
|
+ key=f"class{sep}onclick=alert(1)"
|
|
+ )
|
|
|
|
def test_sort1(self, env):
|
|
tmpl = env.from_string(
|
|
--
|
|
2.45.0
|
|
|