Merge lp:~kees/launchpad-work-items-tracker/fix-escaping into lp:launchpad-work-items-tracker

[Kees Cook]

[Kees Cook (kees)]

This should clean up escaping and catch the assignee href XSS

=== modified file 'workitems.py'
--- workitems.py	2009-12-03 17:28:57 +0000
+++ workitems.py	2009-12-03 19:30:22 +0000
@@ -2,7 +2,7 @@
 
 import urllib, re, sys, optparse, os.path, datetime
 import sqlite3 as dbapi2
-from xml.sax.saxutils import escape
+from cgi import escape
 
 from launchpadlib.launchpad import Launchpad, EDGE_SERVICE_ROOT
 
@@ -431,8 +431,8 @@
     if bp.startswith('http:') or bp.startswith('https:'):
         url = bp
     else:
-        url = '%s/ubuntu/+spec/%s' % (blueprints_base_url, escape(bp))
-    return '<a href="%s">%s</a>' % (url, escape(bp))
+        url = '%s/ubuntu/+spec/%s' % (blueprints_base_url, escape(bp, True))
+    return '<a href="%s">%s</a>' % (url, escape(bp, True))
 
 def html_format_priority(priority):
     prio_colors = {
@@ -443,7 +443,7 @@
             'Essential': 'red'
     }
 
-    p = escape(priority or '')
+    p = escape(priority or '', True)
     col = prio_colors.get(p)
     if col:
         return '<span style="color: %s">%s</span>' % (col, p)
@@ -496,7 +496,7 @@
                 bp_html, data[bp][0], data[bp][2],
                 data[bp][1], percent,
                 html_format_priority(data[bp][-1]),
-                escape(data[bp][-2]))
+                escape(data[bp][-2], True))
 
     print '</table>'
 
@@ -519,9 +519,9 @@
     completion.sort(key=lambda k: k[0], reverse=False)
 
     for (a, percent) in completion:
-        url = '%s/~%s/+specs?role=assignee' % (blueprints_base_url, a)
+        url = '%s/~%s/+specs?role=assignee' % (blueprints_base_url, escape(a, True))
         print '  <tr><td><a href="%s">%s</a></td> <td>%i/%i/%i</td> <td>%i%%</td></tr>' % (
-                url, escape(a), len(data[a][0]), len(data[a][2]),
+                url, escape(a, True), len(data[a][0]), len(data[a][2]),
                 len(data[a][1]), percent)
     print '</table>'
 
@@ -541,7 +541,7 @@
         todo_len = len(todo)
         postponed_len = len(postponed)
         done_len = len(done)
-        url = '%s/~%s/+specs?role=assignee' % (blueprints_base_url, a)
+        url = '%s/~%s/+specs?role=assignee' % (blueprints_base_url, escape(a, True))
         rows = ['<td rowspan="%s">todo</td>' % todo_len,
                 '<td rowspan="%s">postponed</td>' % postponed_len,
                 '<td rowspan="%s">done</td>' % done_len]
@@ -553,7 +553,7 @@
                 print '  <tr>',
                 if not printed_assignee:
                     print '<td rowspan="%s"><a href="%s">%s</a></td> ' % (
-                        todo_len+postponed_len+done_len, url, escape(a)),
+                        todo_len+postponed_len+done_len, url, escape(a, True)),
                     printed_assignee = True
                 if not printed_status:
                     print rows[i]