From 48a4edadb2466d3ceea6fde43ee5aeffd55e17e8 Mon Sep 17 00:00:00 2001 From: Kevin Chung Date: Sun, 6 Feb 2022 02:23:22 -0500 Subject: [PATCH 01/10] Bump bluemonday to 1.0.17 and implement support for RequireSandboxOnIFrame --- bluemonday.go | 19 ++++++++++++++++ build_ffi.py | 2 ++ go.mod | 5 ++++- go.sum | 10 +++++++-- pybluemonday/__init__.py | 29 ++++++++++++++++++++++++- tests/bluemonday/test_sanitize.py | 36 ++++++++++++++++++++++++++++++- 6 files changed, 96 insertions(+), 5 deletions(-) diff --git a/bluemonday.go b/bluemonday.go index 628802d..51d8b56 100644 --- a/bluemonday.go +++ b/bluemonday.go @@ -156,6 +156,25 @@ func CallPolicyFunctionWithBool(policyId C.ulong, method *C.char, argument C.uin meth.Call(args) } +//export CallPolicyFunctionWithInt +func CallPolicyFunctionWithInt(policyId C.ulong, method *C.char, argtype *C.char, argument C.uint) { + goPolicyId := uint32(policyId) + goMethod := C.GoString(method) + goArgType := C.GoString(argtype) + goArgument := int(argument) + policy := POLICIES[goPolicyId] + + switch goArgType { + case "SandboxValue": + sv := bluemonday.SandboxValue(goArgument) + args := []reflect.Value{reflect.ValueOf(sv)} + meth := reflect.ValueOf(policy).MethodByName(goMethod) + meth.Call(args) + default: + panic("Unknown argument type function") + } +} + //export SanitizeWithPolicy func SanitizeWithPolicy(policyId C.ulong, document *C.char) *C.char { goPolicyId := uint32(policyId) diff --git a/build_ffi.py b/build_ffi.py index 90b4c37..01a1e93 100644 --- a/build_ffi.py +++ b/build_ffi.py @@ -29,6 +29,8 @@ extern void CallPolicyFunctionWithBool(long unsigned int p0, char* p1, unsigned int p2); +extern void CallPolicyFunctionWithInt(long unsigned int policyId, char* method, char* argtype, unsigned int argument); + extern char* SanitizeWithPolicy(long unsigned int p0, char* p1); extern void FreeCString(char* p0); diff --git a/go.mod b/go.mod index 680ee02..c65ed22 100644 --- a/go.mod +++ b/go.mod @@ -2,4 +2,7 @@ module pybluemonday go 1.14 -require github.com/microcosm-cc/bluemonday v1.0.16 +require ( + github.com/microcosm-cc/bluemonday v1.0.17 + golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd // indirect +) diff --git a/go.sum b/go.sum index 06cbf36..97e5d76 100644 --- a/go.sum +++ b/go.sum @@ -2,12 +2,18 @@ github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuP github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4= github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY= github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c= -github.com/microcosm-cc/bluemonday v1.0.16 h1:kHmAq2t7WPWLjiGvzKa5o3HzSfahUKiOq7fAPUiMNIc= -github.com/microcosm-cc/bluemonday v1.0.16/go.mod h1:Z0r70sCuXHig8YpBzCc5eGHAap2K7e/u082ZUpDRRqM= +github.com/microcosm-cc/bluemonday v1.0.17 h1:Z1a//hgsQ4yjC+8zEkV8IWySkXnsxmdSY642CTFQb5Y= +github.com/microcosm-cc/bluemonday v1.0.17/go.mod h1:Z0r70sCuXHig8YpBzCc5eGHAap2K7e/u082ZUpDRRqM= golang.org/x/net v0.0.0-20210614182718-04defd469f4e h1:XpT3nA5TvE525Ne3hInMh6+GETgn27Zfm9dxsThnX2Q= golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= +golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd h1:O7DYs+zxREGLKzKoMQrtrEacpb0ZVXA5rIwylE2Xchk= +golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= +golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= diff --git a/pybluemonday/__init__.py b/pybluemonday/__init__.py index 2d47c2e..34d2359 100644 --- a/pybluemonday/__init__.py +++ b/pybluemonday/__init__.py @@ -1,9 +1,28 @@ +from enum import IntEnum, unique from typing import List from unicodedata import normalize from pybluemonday.bluemonday import ffi, lib -__version__ = "0.0.8" +__version__ = "0.0.9" + + +@unique +class SandboxValue(IntEnum): + SandboxAllowDownloads = 0 + SandboxAllowDownloadsWithoutUserActivation = 1 + SandboxAllowForms = 2 + SandboxAllowModals = 3 + SandboxAllowOrientationLock = 4 + SandboxAllowPointerLock = 5 + SandboxAllowPopups = 6 + SandboxAllowPopupsToEscapeSandbox = 7 + SandboxAllowPresentation = 8 + SandboxAllowSameOrigin = 9 + SandboxAllowScripts = 10 + SandboxAllowStorageAccessByUserActivation = 11 + SandboxAllowTopNavigation = 12 + SandboxAllowTopNavigationByUserActivation = 13 class AttrPolicyBuilder: @@ -80,6 +99,14 @@ def method(*args): elif isinstance(args[0], bool): bool_arg = int(args[0]) lib.CallPolicyFunctionWithBool(self._id, method_name, bool_arg) + elif isinstance(args[0], IntEnum): + enum_arg = args[0] + # Get name of the enum to infer what underlying Go type we need + enum_name = enum_arg.__class__.__name__.encode() + int_arg = int(enum_arg) + lib.CallPolicyFunctionWithInt( + self._id, method_name, enum_name, int_arg + ) else: lib.CallPolicyFunction(self._id, method_name) diff --git a/tests/bluemonday/test_sanitize.py b/tests/bluemonday/test_sanitize.py index 705eefc..b1325f3 100644 --- a/tests/bluemonday/test_sanitize.py +++ b/tests/bluemonday/test_sanitize.py @@ -1,4 +1,4 @@ -from pybluemonday import UGCPolicy, StrictPolicy, NewPolicy +from pybluemonday import UGCPolicy, StrictPolicy, NewPolicy, SandboxValue from collections import namedtuple from multiprocessing.pool import ThreadPool, Pool @@ -149,3 +149,37 @@ def test_selectStyleBug(): p.sanitize("