Changeset 13808

Timestamp:

6 Apr 2016, 11:17:16 (9 years ago)

Author:

Henrik Bettermann

Message:

Escape HTML in Logfiles when displayed in Browser.

When logfiles are displayed in datacenter, included
HTML tags should show up as tags and not be rendered
by the browser. We therefore cgi.escape logfile
contents.

See r13495 and r13496.

Location:

main/waeup.ikoba/trunk/src/waeup/ikoba/browser

Files:

• pages.py (modified) (2 diffs)
• pdf.py (modified) (1 diff)
• tests/test_browser.py (modified) (2 diffs)

main/waeup.ikoba/trunk/src/waeup/ikoba/browser/pages.py

@@ -20 +20 @@
 # XXX: All csv ops should move to a dedicated module soon
 import unicodecsv as csv
+import cgi
 import grok
 import os
@@ -1561 +1562 @@
             return
         try:
-            self.result = ''.join(
-                self.context.queryLogfiles(logname, query))
+            self.result = cgi.escape(
+                ''.join(self.context.queryLogfiles(logname, query)))
         except ValueError:
             self.flash(_('Invalid search expression.'), type='danger')

main/waeup.ikoba/trunk/src/waeup/ikoba/browser/pdf.py

@@ -94 +94 @@
     fontName='Helvetica',
     fontSize=10,
-    leading=9,
+    #leading=9,
     )
 

main/waeup.ikoba/trunk/src/waeup/ikoba/browser/tests/test_browser.py

@@ +1 @@
+# -*- coding: utf-8 -*-
 ## $Id: test_browser.py 12840 2015-04-01 08:35:16Z henrik $
 ##
@@ -91 +92 @@
             shutil.rmtree(os.path.dirname(job.result))
 
+    def test_logs_listed(self):
+        # existing logfiles are listed in logs overview
+        self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
+        log_path = os.path.join(
+            self.app['datacenter'].storage, 'logs', 'myspecial.log')
+        with open(log_path, "a") as fd:
+            fd.write("SOME FOO IN LOGFILE")
+        self.browser.open(self.datacenter_path + "/logs")
+        assert "myspecial.log" in self.browser.contents
+
+    def test_view_log(self):
+        # single logfiles can be watched (with filter regexp)
+        self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
+        log_path = os.path.join(
+            self.app['datacenter'].storage, 'logs', 'myspecial.log')
+        with open(log_path, "a") as fd:
+            fd.write("SOME FOO IN LOGFILE")
+        self.browser.open(
+            self.datacenter_path + "/@@show/?logname=myspecial.log&query=.*")
+        assert "SOME FOO IN LOGFILE" in self.browser.contents
+
+    def test_html_in_logs_escaped(self):
+        # HTML code in logfiles is escaped before output.
+        self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
+        log_path = os.path.join(
+            self.app['datacenter'].storage, 'logs', 'myspecial.log')
+        with open(log_path, "a") as fd:
+            fd.write("SOME <TAG> AND ÜMLÄUTS IN LOG")
+        self.browser.open(
+            self.datacenter_path + "/@@show/?logname=myspecial.log&query=.*")
+        assert "SOME &lt;TAG&gt; AND ÜMLÄUTS IN LOG" in self.browser.contents
+
     def test_user_data_import_permission(self):
         upload_path = 'http://localhost/app/datacenter/upload'