|
@@ -1,53 +0,0 @@
|
|
|
-From 9144d0fc5d5249cc4d81287ee79091806e6dde52 Mon Sep 17 00:00:00 2001
|
|
|
-From: Gareth Simpson <gareth.simpson@zoodigital.com>
|
|
|
-Date: Fri, 1 May 2020 19:31:21 +0100
|
|
|
-Subject: [PATCH] Fix for issue 348 - incomplete tags with punctuation after as
|
|
|
- part of the tag name are a source of XSS
|
|
|
-
|
|
|
-Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
|
|
|
-[Retrieved from:
|
|
|
-https://github.com/trentm/python-markdown2/commit/9144d0fc5d5249cc4d81287ee79091806e6dde52]
|
|
|
----
|
|
|
- lib/markdown2.py | 2 +-
|
|
|
- test/tm-cases/issue348_incomplete_tag.html | 1 +
|
|
|
- test/tm-cases/issue348_incomplete_tag.opts | 1 +
|
|
|
- test/tm-cases/issue348_incomplete_tag.text | 1 +
|
|
|
- 4 files changed, 4 insertions(+), 1 deletion(-)
|
|
|
- create mode 100644 test/tm-cases/issue348_incomplete_tag.html
|
|
|
- create mode 100644 test/tm-cases/issue348_incomplete_tag.opts
|
|
|
- create mode 100644 test/tm-cases/issue348_incomplete_tag.text
|
|
|
-
|
|
|
-diff --git a/lib/markdown2.py b/lib/markdown2.py
|
|
|
-index 3a5d5d9..636bf07 100755
|
|
|
---- a/lib/markdown2.py
|
|
|
-+++ b/lib/markdown2.py
|
|
|
-@@ -2164,7 +2164,7 @@ def _encode_amps_and_angles(self, text):
|
|
|
- text = self._naked_gt_re.sub('>', text)
|
|
|
- return text
|
|
|
-
|
|
|
-- _incomplete_tags_re = re.compile("<(/?\w+[\s/]+?)")
|
|
|
-+ _incomplete_tags_re = re.compile("<(/?\w+?(?!://).?[\s/]+?)")
|
|
|
-
|
|
|
- def _encode_incomplete_tags(self, text):
|
|
|
- if self.safe_mode not in ("replace", "escape"):
|
|
|
-diff --git a/test/tm-cases/issue348_incomplete_tag.html b/test/tm-cases/issue348_incomplete_tag.html
|
|
|
-new file mode 100644
|
|
|
-index 0000000..46059cc
|
|
|
---- /dev/null
|
|
|
-+++ b/test/tm-cases/issue348_incomplete_tag.html
|
|
|
-@@ -0,0 +1 @@
|
|
|
-+<p><lol@/ //id="pwn"//onclick="alert(1)"//<strong>abc</strong></p>
|
|
|
-diff --git a/test/tm-cases/issue348_incomplete_tag.opts b/test/tm-cases/issue348_incomplete_tag.opts
|
|
|
-new file mode 100644
|
|
|
-index 0000000..ad487c0
|
|
|
---- /dev/null
|
|
|
-+++ b/test/tm-cases/issue348_incomplete_tag.opts
|
|
|
-@@ -0,0 +1 @@
|
|
|
-+{"safe_mode": "escape"}
|
|
|
-diff --git a/test/tm-cases/issue348_incomplete_tag.text b/test/tm-cases/issue348_incomplete_tag.text
|
|
|
-new file mode 100644
|
|
|
-index 0000000..bb4a0de
|
|
|
---- /dev/null
|
|
|
-+++ b/test/tm-cases/issue348_incomplete_tag.text
|
|
|
-@@ -0,0 +1 @@
|
|
|
-+<lol@/ //id="pwn"//onclick="alert(1)"//**abc**
|