Changeset 1836

Timestamp:

11/03/08 15:54:57 (2 months ago)

Author:

rmarianski

Message:

beginnings of using lxml.html cleaner to sanitize user embed markup

Location:

siteapp/branches/clean-embed

Files:

• data/embed.cfg (added)
• opengeo/almanac/configutil.py (modified) (1 diff)
• opengeo/almanac/content.py (modified) (4 diffs)

siteapp/branches/clean-embed/opengeo/almanac/configutil.py

@@ -187 +187 @@
                     direct=True)
 
+class EmbedRegister(ConfigLoadingUtil):
+    default = '/data/embed.cfg'
+
+embedreg = EmbedRegister.from_spec()
+grok.global_utility(embedreg,
+                    provides=IConfigValues,
+                    name="almanac.embed",
+                    direct=True)
+
 
 def test_suite():

siteapp/branches/clean-embed/opengeo/almanac/content.py

@@ -2 +2 @@
 Our basic content and pedestrian add and edit views
 """
+from lxml.html.clean import Cleaner
 from opengeo.almanac import app
 from opengeo.almanac import kml
@@ -169 +170 @@
     elif type == 'video':
         story.type = 'video'
-        story.body = extra_data['video']
+        markup = extra_data['video']
+        story.body = clean_embed_markup(markup)
     else:
         # assume text if it's not an image or video
@@ -191 +193 @@
 
     return story
+
+
+def clean_embed_markup(markup):
+    cfg = getUtility(IConfigValues, name='almanac.embed')
+    cfg = cfg['embed']
+    allow_tags = cfg.allow_tags.split(',')
+    host_whitelist = cfg.host_whitelist.split(',')
+
+    # prefix www subdomain to all hosts as a convenience
+    host_whitelist = set([x.strip() for x in host_whitelist])
+    for host in list(host_whitelist):
+        if not host.startswith('www.'):
+            host_whitelist.add('www.' + host)
+
+    cleaner = Cleaner(allow_tags=allow_tags,
+                      remove_unknown_tags=False,
+                      whitelist_tags=allow_tags,
+                      host_whitelist=host_whitelist)
+    import pdb; pdb.set_trace()
+    return cleaner.clean_html(markup)
 
 class BaseModel(grok.Model):
@@ -823 +845 @@
             self.context.photoid = photoid
         elif self.context.type == 'video' and 'video' in self.request.form:
-            self.context.body = self.request.form['video']
+            self.context.body = clean_embed_markup(self.request.form['video'])
         elif self.context.type == 'text' and 'words' in self.request.form:
             self.context.body = self.request.form['words']