Merge lp:~sinzui/launchpad/product-release-file-api into lp:launchpad/db-devel

[Curtis Hovey]

[Curtis Hovey (sinzui)]

This is my branch to secure <ProductReleaseFile>/fmt:link.

    lp:~sinzui/launchpad/product-release-file-api
    Diff size: 34
    Launchpad bug: https://bugs.launchpad.net/bugs/529370
    Test command: ./bin/test -vv \
        -t doc/tales.txt
    Pre-implementation: no one.
    Target release: 10.02

Secure <ProductReleaseFile>/fmt:link
------------------------------------

ProductReleaseFileFormatterAPI.link injects ProductReleaseFile.description
into a title attribute without any escaping.

Rules
-----

    * Update the tales link formatter for ProductReleaseFile to escape the
      the description.

QA
--

    * Upload a file and set the description to:
      ><script>window.alert('xss attack')</script>
    * Verify when viewing the file on the release or download page that
      you do not get a popup, instead you see the text when you hover over
      the file link.

Lint
----

Linting changed files:
  lib/canonical/launchpad/doc/tales.txt
  lib/canonical/launchpad/webapp/tales.py

Test
----

    * lib/canonical/launchpad/doc/tales.txt
      Added a test to verify that the description is escaped in the
      link's title attribute.

Implementation
--------------

    * lib/canonical/launchpad/webapp/tales.py
      Used cgi.escape() to create a safe description that can be placed
      in the title of a link to download the file.

[Brad Crittenden (bac)]

review: Approve (code)

[Tim Penhey (thumper)]

review: Approve (release-critical)

=== modified file 'lib/canonical/launchpad/doc/tales.txt'
--- lib/canonical/launchpad/doc/tales.txt	2010-02-23 15:10:46 +0000
+++ lib/canonical/launchpad/doc/tales.txt	2010-03-01 21:21:25 +0000
@@ -646,6 +646,16 @@
     >>> print test_tales("release_file/fmt:url", release_file=release_file)
     http://launchpad.dev/.../+download/test.txt
 
+HTML in the file description is escaped in the fmt:link.
+
+    >>> release_file.description = (
+    ...     '><script>XSS failed</script>')
+    >>> print test_tales("release_file/fmt:link", release_file=release_file)
+    <img ...
+    <a title="&gt;&lt;script&gt;XSS failed&lt;/script&gt; (4 bytes)"
+    href="http://launchpad.dev/.../+download/test.txt">test.txt</a> ...
+
+
 
 Product series
 ..............

=== modified file 'lib/canonical/launchpad/webapp/tales.py'
--- lib/canonical/launchpad/webapp/tales.py	2010-02-17 14:46:57 +0000
+++ lib/canonical/launchpad/webapp/tales.py	2010-03-01 21:21:25 +0000
@@ -1348,7 +1348,7 @@
         file_size = NumberFormatterAPI(
             file_.libraryfile.content.filesize).bytes()
         if file_.description is not None:
-            description = file_.description
+            description = cgi.escape(file_.description)
         else:
             description = file_.libraryfile.filename
         link_title = "%s (%s)" % (description, file_size)