Merge lp:~willmoggridge/usn-tool/sanitizehtml into lp:usn-tool

[Will Moggridge]

Update markdown content escaping.
Move the function to a macro and add escaping to HTML by converting < and > to HTMl attributes.

[Tyler Hicks (tyhicks)]

It looks like this change is doing something odd in USN-288-1. I see this in the new site:

"... which is the representation of the backslash character >>&lt;< in ASCII."

It should be displaying ">>/<<" instead of ">>&lt;<".

Is that hugo getting confused by the backslash in "&gt;&gt;\&lt;&lt;"?

I admit that this is an overly complex USN text so I don't necessarily consider this a blocker. I was just wondering if you could easily spot the problem?

review: Needs Information

[Tyler Hicks (tyhicks)]

Approving and merging this but I'd still like the issue I described above to be addressed if you see a way to fix it.

review: Approve

=== modified file 'templates/webpage-markdown.txt'
--- templates/webpage-markdown.txt	2018-02-23 06:07:03 +0000
+++ templates/webpage-markdown.txt	2018-03-05 13:20:46 +0000
@@ -1,5 +1,15 @@
 {# http://genshi.edgewall.org/wiki/Documentation/text-templates.html #}\
 {# This is a template that may eventually be used to generate markdown for a new USN site #}\
+{# Replace single backslash with two (which requires a lot of backslashes), escape double quotes and HTML. #}\
+{% def sanitize(input) %}\
+${\
+    input.strip()\
+    .replace('\\\','\')\
+    .replace('"','"')\
+    .replace('<', '&lt;')\
+    .replace('>', '&gt;')\
+}\
+{% end %}\
 {% if defined('cves') %}\
 {% if cves.sort() %}{% end %}\
 {% end %}\
@@ -13,8 +23,7 @@
 ]
 date: ${timestr}
 {% with short_description=(description[:350].rsplit(' ', 1)[0]+'...') if len(description) > 350 else description %}\
-{# Replace single backslash with two (which requires a lot of backslashes) and escape double quotes. #}\
-description: "{% if defined('description') %}${short_description.replace('\\\','\\\\\\\').replace('"','\\\"')}{% end %}"
+description: "{% if defined('description') %}${sanitize(short_description)}{% end %}"
 {% end %}\
 ---
 {% end %}\
@@ -39,13 +48,13 @@
 ### Software Description
 
 {% for name, description in package_descriptions.iteritems() %}\
-* ${name}{% if len(description) > 0 %} - ${description}{% end %}
+* ${name}{% if len(description) > 0 %} - ${sanitize(description)}{% end %}
 {% end %}\
 {% end %}\
 
 ### Details
 
-${description.strip()}
+${sanitize(description)}
 
 ## Update instructions