Changeset 13495 for main

Timestamp:

24 Nov 2015, 21:05:02 (9 years ago)

Author:

uli

Message:

Escape HTML in Logfiles when displayed in Browser.

When logfiles are displayed in datacenter, included
HTML tags should show up as tags and not be rendered
by the browser. We therefore cgi.escape logfile
contents.

Location:

main/waeup.kofa/trunk/src/waeup/kofa/browser

Files:

• pages.py (modified) (2 diffs)
• tests/test_browser.py (modified) (2 diffs)

main/waeup.kofa/trunk/src/waeup/kofa/browser/pages.py

@@ -19 +19 @@
 """
 # XXX: All csv ops should move to a dedicated module soon
+import cgi
 import unicodecsv as csv
 import grok
@@ -1734 +1735 @@
             return
         try:
-            self.result = ''.join(
-                self.context.queryLogfiles(logname, query))
+            lines = self.context.queryLogfiles(logname, query)
+            self.result = ''.join([cgi.escape(line) for line in lines])
         except ValueError:
             self.flash(_('Invalid search expression.'), type='danger')

main/waeup.kofa/trunk/src/waeup/kofa/browser/tests/test_browser.py

@@ +1 @@
+# -*- coding: utf-8 -*-
 ## $Id$
 ## 
@@ -114 +115 @@
         return
 
+    def test_logs_listed(self):
+        # existing logfiles are listed in logs overview
+        self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
+        log_path = os.path.join(
+            self.app['datacenter'].storage, 'logs', 'myspecial.log')
+        with open(log_path, "a") as fd:
+            fd.write("SOME FOO IN LOGFILE")
+        self.browser.open(self.datacenter_path + "/logs")
+        assert "myspecial.log" in self.browser.contents
+
+    def test_view_log(self):
+        # single logfiles can be watched (with filter regexp)
+        self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
+        log_path = os.path.join(
+            self.app['datacenter'].storage, 'logs', 'myspecial.log')
+        with open(log_path, "a") as fd:
+            fd.write("SOME FOO IN LOGFILE")
+        self.browser.open(
+            self.datacenter_path + "/@@show/?logname=myspecial.log&query=.*")
+        assert "SOME FOO IN LOGFILE" in self.browser.contents
+
+    def test_html_in_logs_escaped(self):
+        # HTML code in logfiles is escaped before output.
+        self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
+        log_path = os.path.join(
+            self.app['datacenter'].storage, 'logs', 'myspecial.log')
+        with open(log_path, "a") as fd:
+            fd.write("SOME <TAG> AND ÜMLÄUTS IN LOG")
+        self.browser.open(
+            self.datacenter_path + "/@@show/?logname=myspecial.log&query=.*")
+        assert "SOME &lt;TAG&gt; AND ÜMLÄUTS IN LOG" in self.browser.contents
+
     def test_file_download_delete(self):
         self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')