From fecbdffee824da8843b77d88300784fdad7fc0e8 Mon Sep 17 00:00:00 2001 From: Eldeberen Date: Mon, 22 Feb 2021 23:54:47 +0100 Subject: [PATCH 01/99] polls: add link in admin panel --- app/templates/admin/index.html | 1 + 1 file changed, 1 insertion(+) diff --git a/app/templates/admin/index.html b/app/templates/admin/index.html index 26694eb..d39d7bd 100644 --- a/app/templates/admin/index.html +++ b/app/templates/admin/index.html @@ -12,6 +12,7 @@
  • Liste des membres
  • Titres et trophées
  • Arbre des forums
  • +
  • Sondages
  • Pièces-jointes
  • Configuration du site
  • From eba1b7dd3b8b27551078e7258fd9c48bddba4ad8 Mon Sep 17 00:00:00 2001 From: Darks Date: Tue, 23 Feb 2021 12:00:34 +0100 Subject: [PATCH 02/99] markdown: better input sanitization --- app/utils/filters/markdown.py | 12 +++--------- app/utils/markdown_extensions/escape_html.py | 7 +++++++ 2 files changed, 10 insertions(+), 9 deletions(-) create mode 100644 app/utils/markdown_extensions/escape_html.py diff --git a/app/utils/filters/markdown.py b/app/utils/filters/markdown.py index f7455a9..721b226 100644 --- a/app/utils/filters/markdown.py +++ b/app/utils/filters/markdown.py @@ -6,6 +6,7 @@ from markdown.extensions.footnotes import FootnoteExtension from markdown.extensions.toc import TocExtension from app.utils.markdown_extensions.pclinks import PCLinkExtension +from app.utils.markdown_extensions.escape_html import EscapeHtml @app.template_filter('md') @@ -22,19 +23,12 @@ def md(text): 'sane_lists', 'tables', CodeHiliteExtension(linenums=True, use_pygments=True), + EscapeHtml(), FootnoteExtension(UNIQUE_IDS=True), TocExtension(baselevel=2), PCLinkExtension(), ] - def escape(text): - text = text.replace("&", "&") - text = text.replace("<", "<") - text = text.replace(">", ">") - return text - - # Escape html chars because markdown does not - safe = escape(text) - out = markdown(safe, options=options, extensions=extensions) + out = markdown(text, options=options, extensions=extensions) return Markup(out) diff --git a/app/utils/markdown_extensions/escape_html.py b/app/utils/markdown_extensions/escape_html.py new file mode 100644 index 0000000..28f00a8 --- /dev/null +++ b/app/utils/markdown_extensions/escape_html.py @@ -0,0 +1,7 @@ +from markdown.extensions import Extension + + +class EscapeHtml(Extension): + def extendMarkdown(self, md): + md.preprocessors.deregister('html_block') + md.inlinePatterns.deregister('html') From 6136c6e9bf22125c7aafc794b27674f5fe7c6fa3 Mon Sep 17 00:00:00 2001 From: Darks Date: Tue, 23 Feb 2021 13:30:09 +0100 Subject: [PATCH 03/99] markdown: add better sanitization And disable nl2br extension --- app/utils/bleach_allowlist.py | 414 ++++++++++++++++++++++++++++++++++ app/utils/filters/markdown.py | 7 +- 2 files changed, 419 insertions(+), 2 deletions(-) create mode 100644 app/utils/bleach_allowlist.py diff --git a/app/utils/bleach_allowlist.py b/app/utils/bleach_allowlist.py new file mode 100644 index 0000000..bb2d346 --- /dev/null +++ b/app/utils/bleach_allowlist.py @@ -0,0 +1,414 @@ +all_tags = [ + "a", "abbr", "acronym", "address", "applet", "area", "article", "aside", "audio", + "b", "base", "basefont", "bdi", "bdo", "bgsound", "big", "blink", "blockquote", "body", "br", "button", + "canvas", "caption", "center", "cite", "code", "col", "colgroup", "command", "content", + "data", "datalist", "dd", "del", "detals", "dfn", "dialog", "dir", "div", "dl", "dt", + "element", "em", "embed", + "fieldset", "figcaption", "figure", "font", "footer", "form", "frame", "frameset", + "h1", "h2", "h3", "h4", "h5", "h6", "head", "header", "hgroup", "hr", "html", + "i", "iframe", "image", "img", "input", "ins", "isindex", + "kbd", "keygen", + "label", "legend", "li", "link", "listing", + "main", "map", "mark", "marquee", "menu", "menuitem", "meta", "meter", "multicol", + "nav", "nobr", "noembed", "noframes", "noscript", + "object", "ol", "optgroup", "option", "output", + "p", "param", "picture", "plaintext", "pre", "progress", + "q", + "rp", "rt", "ruby", + "s", "samp", "script", "section", "select", "shadow", "small", "source", "spacer", "span", "strike", "strong", "style", "sub", "summary", "sup", + "table", "tbody", "td", "template", "textarea", "tfoot", "th", "thead", "time", "title", "tr", "track", "tt", + "u", "ul", + "var", "video", + "wbr", + "xmp", +] + +# List tags that, if included in a page, could break markup or open XSS. +generally_xss_unsafe = [ + "applet", "audio", + "bgsound", "body", + "canvas", + "embed", + "frame", "frameset", + "head", "html", + "iframe", + "link", + "meta", + "object", + "param", + "source", "script", + "ruby", "rt", + "title", "track", + "video", + "xmp" +] + +# Tags that, if included on the page, will probably not break markup or open +# XSS. Note that these must be combined with attribute allow-lists, or things +# like and