PageRenderTime 69ms CodeModel.GetById 15ms RepoModel.GetById 0ms app.codeStats 0ms

/pip/_vendor/html5lib/sanitizer.py

https://github.com/ptthiem/pip
Python | 271 lines | 233 code | 24 blank | 14 comment | 19 complexity | be7efae71dcfa21f93d0b8068fc4a047 MD5 | raw file
    

  1. from __future__ import absolute_import, division, unicode_literals
    2. 

  2. 

  3. import re
    4. 

  4. from xml.sax.saxutils import escape, unescape
    5. 

  5. 

  6. from .tokenizer import HTMLTokenizer
    7. 

  7. from .constants import tokenTypes
    8. 

  8. 

  9. 

  10. class HTMLSanitizerMixin(object):
    11. 

  11.     """ sanitization of XHTML+MathML+SVG and of inline style attributes."""
    12. 

  12. 

  13.     acceptable_elements = ['a', 'abbr', 'acronym', 'address', 'area',
    14. 

  14.                            'article', 'aside', 'audio', 'b', 'big', 'blockquote', 'br', 'button',
    15. 

  15.                            'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup',
    16. 

  16.                            'command', 'datagrid', 'datalist', 'dd', 'del', 'details', 'dfn',
    17. 

  17.                            'dialog', 'dir', 'div', 'dl', 'dt', 'em', 'event-source', 'fieldset',
    18. 

  18.                            'figcaption', 'figure', 'footer', 'font', 'form', 'header', 'h1',
    19. 

  19.                            'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'input', 'ins',
    20. 

  20.                            'keygen', 'kbd', 'label', 'legend', 'li', 'm', 'map', 'menu', 'meter',
    21. 

  21.                            'multicol', 'nav', 'nextid', 'ol', 'output', 'optgroup', 'option',
    22. 

  22.                            'p', 'pre', 'progress', 'q', 's', 'samp', 'section', 'select',
    23. 

  23.                            'small', 'sound', 'source', 'spacer', 'span', 'strike', 'strong',
    24. 

  24.                            'sub', 'sup', 'table', 'tbody', 'td', 'textarea', 'time', 'tfoot',
    25. 

  25.                            'th', 'thead', 'tr', 'tt', 'u', 'ul', 'var', 'video']
    26. 

  26. 

  27.     mathml_elements = ['maction', 'math', 'merror', 'mfrac', 'mi',
    28. 

  28.                        'mmultiscripts', 'mn', 'mo', 'mover', 'mpadded', 'mphantom',
    29. 

  29.                        'mprescripts', 'mroot', 'mrow', 'mspace', 'msqrt', 'mstyle', 'msub',
    30. 

  30.                        'msubsup', 'msup', 'mtable', 'mtd', 'mtext', 'mtr', 'munder',
    31. 

  31.                        'munderover', 'none']
    32. 

  32. 

  33.     svg_elements = ['a', 'animate', 'animateColor', 'animateMotion',
    34. 

  34.                     'animateTransform', 'clipPath', 'circle', 'defs', 'desc', 'ellipse',
    35. 

  35.                     'font-face', 'font-face-name', 'font-face-src', 'g', 'glyph', 'hkern',
    36. 

  36.                     'linearGradient', 'line', 'marker', 'metadata', 'missing-glyph',
    37. 

  37.                     'mpath', 'path', 'polygon', 'polyline', 'radialGradient', 'rect',
    38. 

  38.                     'set', 'stop', 'svg', 'switch', 'text', 'title', 'tspan', 'use']
    39. 

  39. 

  40.     acceptable_attributes = ['abbr', 'accept', 'accept-charset', 'accesskey',
    41. 

  41.                              'action', 'align', 'alt', 'autocomplete', 'autofocus', 'axis',
    42. 

  42.                              'background', 'balance', 'bgcolor', 'bgproperties', 'border',
    43. 

  43.                              'bordercolor', 'bordercolordark', 'bordercolorlight', 'bottompadding',
    44. 

  44.                              'cellpadding', 'cellspacing', 'ch', 'challenge', 'char', 'charoff',
    45. 

  45.                              'choff', 'charset', 'checked', 'cite', 'class', 'clear', 'color',
    46. 

  46.                              'cols', 'colspan', 'compact', 'contenteditable', 'controls', 'coords',
    47. 

  47.                              'data', 'datafld', 'datapagesize', 'datasrc', 'datetime', 'default',
    48. 

  48.                              'delay', 'dir', 'disabled', 'draggable', 'dynsrc', 'enctype', 'end',
    49. 

  49.                              'face', 'for', 'form', 'frame', 'galleryimg', 'gutter', 'headers',
    50. 

  50.                              'height', 'hidefocus', 'hidden', 'high', 'href', 'hreflang', 'hspace',
    51. 

  51.                              'icon', 'id', 'inputmode', 'ismap', 'keytype', 'label', 'leftspacing',
    52. 

  52.                              'lang', 'list', 'longdesc', 'loop', 'loopcount', 'loopend',
    53. 

  53.                              'loopstart', 'low', 'lowsrc', 'max', 'maxlength', 'media', 'method',
    54. 

  54.                              'min', 'multiple', 'name', 'nohref', 'noshade', 'nowrap', 'open',
    55. 

  55.                              'optimum', 'pattern', 'ping', 'point-size', 'poster', 'pqg', 'preload',
    56. 

  56.                              'prompt', 'radiogroup', 'readonly', 'rel', 'repeat-max', 'repeat-min',
    57. 

  57.                              'replace', 'required', 'rev', 'rightspacing', 'rows', 'rowspan',
    58. 

  58.                              'rules', 'scope', 'selected', 'shape', 'size', 'span', 'src', 'start',
    59. 

  59.                              'step', 'style', 'summary', 'suppress', 'tabindex', 'target',
    60. 

  60.                              'template', 'title', 'toppadding', 'type', 'unselectable', 'usemap',
    61. 

  61.                              'urn', 'valign', 'value', 'variable', 'volume', 'vspace', 'vrml',
    62. 

  62.                              'width', 'wrap', 'xml:lang']
    63. 

  63. 

  64.     mathml_attributes = ['actiontype', 'align', 'columnalign', 'columnalign',
    65. 

  65.                          'columnalign', 'columnlines', 'columnspacing', 'columnspan', 'depth',
    66. 

  66.                          'display', 'displaystyle', 'equalcolumns', 'equalrows', 'fence',
    67. 

  67.                          'fontstyle', 'fontweight', 'frame', 'height', 'linethickness', 'lspace',
    68. 

  68.                          'mathbackground', 'mathcolor', 'mathvariant', 'mathvariant', 'maxsize',
    69. 

  69.                          'minsize', 'other', 'rowalign', 'rowalign', 'rowalign', 'rowlines',
    70. 

  70.                          'rowspacing', 'rowspan', 'rspace', 'scriptlevel', 'selection',
    71. 

  71.                          'separator', 'stretchy', 'width', 'width', 'xlink:href', 'xlink:show',
    72. 

  72.                          'xlink:type', 'xmlns', 'xmlns:xlink']
    73. 

  73. 

  74.     svg_attributes = ['accent-height', 'accumulate', 'additive', 'alphabetic',
    75. 

  75.                       'arabic-form', 'ascent', 'attributeName', 'attributeType',
    76. 

  76.                       'baseProfile', 'bbox', 'begin', 'by', 'calcMode', 'cap-height',
    77. 

  77.                       'class', 'clip-path', 'color', 'color-rendering', 'content', 'cx',
    78. 

  78.                       'cy', 'd', 'dx', 'dy', 'descent', 'display', 'dur', 'end', 'fill',
    79. 

  79.                       'fill-opacity', 'fill-rule', 'font-family', 'font-size',
    80. 

  80.                       'font-stretch', 'font-style', 'font-variant', 'font-weight', 'from',
    81. 

  81.                       'fx', 'fy', 'g1', 'g2', 'glyph-name', 'gradientUnits', 'hanging',
    82. 

  82.                       'height', 'horiz-adv-x', 'horiz-origin-x', 'id', 'ideographic', 'k',
    83. 

  83.                       'keyPoints', 'keySplines', 'keyTimes', 'lang', 'marker-end',
    84. 

  84.                       'marker-mid', 'marker-start', 'markerHeight', 'markerUnits',
    85. 

  85.                       'markerWidth', 'mathematical', 'max', 'min', 'name', 'offset',
    86. 

  86.                       'opacity', 'orient', 'origin', 'overline-position',
    87. 

  87.                       'overline-thickness', 'panose-1', 'path', 'pathLength', 'points',
    88. 

  88.                       'preserveAspectRatio', 'r', 'refX', 'refY', 'repeatCount',
    89. 

  89.                       'repeatDur', 'requiredExtensions', 'requiredFeatures', 'restart',
    90. 

  90.                       'rotate', 'rx', 'ry', 'slope', 'stemh', 'stemv', 'stop-color',
    91. 

  91.                       'stop-opacity', 'strikethrough-position', 'strikethrough-thickness',
    92. 

  92.                       'stroke', 'stroke-dasharray', 'stroke-dashoffset', 'stroke-linecap',
    93. 

  93.                       'stroke-linejoin', 'stroke-miterlimit', 'stroke-opacity',
    94. 

  94.                       'stroke-width', 'systemLanguage', 'target', 'text-anchor', 'to',
    95. 

  95.                       'transform', 'type', 'u1', 'u2', 'underline-position',
    96. 

  96.                       'underline-thickness', 'unicode', 'unicode-range', 'units-per-em',
    97. 

  97.                       'values', 'version', 'viewBox', 'visibility', 'width', 'widths', 'x',
    98. 

  98.                       'x-height', 'x1', 'x2', 'xlink:actuate', 'xlink:arcrole',
    99. 

  99.                       'xlink:href', 'xlink:role', 'xlink:show', 'xlink:title', 'xlink:type',
    100. 

  100.                       'xml:base', 'xml:lang', 'xml:space', 'xmlns', 'xmlns:xlink', 'y',
    101. 

  101.                       'y1', 'y2', 'zoomAndPan']
    102. 

  102. 

  103.     attr_val_is_uri = ['href', 'src', 'cite', 'action', 'longdesc', 'poster',
    104. 

  104.                        'xlink:href', 'xml:base']
    105. 

  105. 

  106.     svg_attr_val_allows_ref = ['clip-path', 'color-profile', 'cursor', 'fill',
    107. 

  107.                                'filter', 'marker', 'marker-start', 'marker-mid', 'marker-end',
    108. 

  108.                                'mask', 'stroke']
    109. 

  109. 

  110.     svg_allow_local_href = ['altGlyph', 'animate', 'animateColor',
    111. 

  111.                             'animateMotion', 'animateTransform', 'cursor', 'feImage', 'filter',
    112. 

  112.                             'linearGradient', 'pattern', 'radialGradient', 'textpath', 'tref',
    113. 

  113.                             'set', 'use']
    114. 

  114. 

  115.     acceptable_css_properties = ['azimuth', 'background-color',
    116. 

  116.                                  'border-bottom-color', 'border-collapse', 'border-color',
    117. 

  117.                                  'border-left-color', 'border-right-color', 'border-top-color', 'clear',
    118. 

  118.                                  'color', 'cursor', 'direction', 'display', 'elevation', 'float', 'font',
    119. 

  119.                                  'font-family', 'font-size', 'font-style', 'font-variant', 'font-weight',
    120. 

  120.                                  'height', 'letter-spacing', 'line-height', 'overflow', 'pause',
    121. 

  121.                                  'pause-after', 'pause-before', 'pitch', 'pitch-range', 'richness',
    122. 

  122.                                  'speak', 'speak-header', 'speak-numeral', 'speak-punctuation',
    123. 

  123.                                  'speech-rate', 'stress', 'text-align', 'text-decoration', 'text-indent',
    124. 

  124.                                  'unicode-bidi', 'vertical-align', 'voice-family', 'volume',
    125. 

  125.                                  'white-space', 'width']
    126. 

  126. 

  127.     acceptable_css_keywords = ['auto', 'aqua', 'black', 'block', 'blue',
    128. 

  128.                                'bold', 'both', 'bottom', 'brown', 'center', 'collapse', 'dashed',
    129. 

  129.                                'dotted', 'fuchsia', 'gray', 'green', '!important', 'italic', 'left',
    130. 

  130.                                'lime', 'maroon', 'medium', 'none', 'navy', 'normal', 'nowrap', 'olive',
    131. 

  131.                                'pointer', 'purple', 'red', 'right', 'solid', 'silver', 'teal', 'top',
    132. 

  132.                                'transparent', 'underline', 'white', 'yellow']
    133. 

  133. 

  134.     acceptable_svg_properties = ['fill', 'fill-opacity', 'fill-rule',
    135. 

  135.                                  'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin',
    136. 

  136.                                  'stroke-opacity']
    137. 

  137. 

  138.     acceptable_protocols = ['ed2k', 'ftp', 'http', 'https', 'irc',
    139. 

  139.                             'mailto', 'news', 'gopher', 'nntp', 'telnet', 'webcal',
    140. 

  140.                             'xmpp', 'callto', 'feed', 'urn', 'aim', 'rsync', 'tag',
    141. 

  141.                             'ssh', 'sftp', 'rtsp', 'afs']
    142. 

  142. 

  143.     # subclasses may define their own versions of these constants
    144. 

  144.     allowed_elements = acceptable_elements + mathml_elements + svg_elements
    145. 

  145.     allowed_attributes = acceptable_attributes + mathml_attributes + svg_attributes
    146. 

  146.     allowed_css_properties = acceptable_css_properties
    147. 

  147.     allowed_css_keywords = acceptable_css_keywords
    148. 

  148.     allowed_svg_properties = acceptable_svg_properties
    149. 

  149.     allowed_protocols = acceptable_protocols
    150. 

  150. 

  151.     # Sanitize the +html+, escaping all elements not in ALLOWED_ELEMENTS, and
    152. 

  152.     # stripping out all # attributes not in ALLOWED_ATTRIBUTES. Style
    153. 

  153.     # attributes are parsed, and a restricted set, # specified by
    154. 

  154.     # ALLOWED_CSS_PROPERTIES and ALLOWED_CSS_KEYWORDS, are allowed through.
    155. 

  155.     # attributes in ATTR_VAL_IS_URI are scanned, and only URI schemes specified
    156. 

  156.     # in ALLOWED_PROTOCOLS are allowed.
    157. 

  157.     #
    158. 

  158.     #   sanitize_html('<script> do_nasty_stuff() </script>')
    159. 

  159.     #    => &lt;script> do_nasty_stuff() &lt;/script>
    160. 

  160.     #   sanitize_html('<a href="javascript: sucker();">Click here for $100</a>')
    161. 

  161.     #    => <a>Click here for $100</a>
    162. 

  162.     def sanitize_token(self, token):
    163. 

  163. 

  164.         # accommodate filters which use token_type differently
    165. 

  165.         token_type = token["type"]
    166. 

  166.         if token_type in list(tokenTypes.keys()):
    167. 

  167.             token_type = tokenTypes[token_type]
    168. 

  168. 

  169.         if token_type in (tokenTypes["StartTag"], tokenTypes["EndTag"],
    170. 

  170.                           tokenTypes["EmptyTag"]):
    171. 

  171.             if token["name"] in self.allowed_elements:
    172. 

  172.                 return self.allowed_token(token, token_type)
    173. 

  173.             else:
    174. 

  174.                 return self.disallowed_token(token, token_type)
    175. 

  175.         elif token_type == tokenTypes["Comment"]:
    176. 

  176.             pass
    177. 

  177.         else:
    178. 

  178.             return token
    179. 

  179. 

  180.     def allowed_token(self, token, token_type):
    181. 

  181.         if "data" in token:
    182. 

  182.             attrs = dict([(name, val) for name, val in
    183. 

  183.                           token["data"][::-1]
    184. 

  184.                           if name in self.allowed_attributes])
    185. 

  185.             for attr in self.attr_val_is_uri:
    186. 

  186.                 if attr not in attrs:
    187. 

  187.                     continue
    188. 

  188.                 val_unescaped = re.sub("[`\000-\040\177-\240\s]+", '',
    189. 

  189.                                        unescape(attrs[attr])).lower()
    190. 

  190.                 # remove replacement characters from unescaped characters
    191. 

  191.                 val_unescaped = val_unescaped.replace("\ufffd", "")
    192. 

  192.                 if (re.match("^[a-z0-9][-+.a-z0-9]*:", val_unescaped) and
    193. 

  193.                     (val_unescaped.split(':')[0] not in
    194. 

  194.                      self.allowed_protocols)):
    195. 

  195.                     del attrs[attr]
    196. 

  196.             for attr in self.svg_attr_val_allows_ref:
    197. 

  197.                 if attr in attrs:
    198. 

  198.                     attrs[attr] = re.sub(r'url\s*\(\s*[^#\s][^)]+?\)',
    199. 

  199.                                          ' ',
    200. 

  200.                                          unescape(attrs[attr]))
    201. 

  201.             if (token["name"] in self.svg_allow_local_href and
    202. 

  202.                 'xlink:href' in attrs and re.search('^\s*[^#\s].*',
    203. 

  203.                                                     attrs['xlink:href'])):
    204. 

  204.                 del attrs['xlink:href']
    205. 

  205.             if 'style' in attrs:
    206. 

  206.                 attrs['style'] = self.sanitize_css(attrs['style'])
    207. 

  207.             token["data"] = [[name, val] for name, val in list(attrs.items())]
    208. 

  208.         return token
    209. 

  209. 

  210.     def disallowed_token(self, token, token_type):
    211. 

  211.         if token_type == tokenTypes["EndTag"]:
    212. 

  212.             token["data"] = "</%s>" % token["name"]
    213. 

  213.         elif token["data"]:
    214. 

  214.             attrs = ''.join([' %s="%s"' % (k, escape(v)) for k, v in token["data"]])
    215. 

  215.             token["data"] = "<%s%s>" % (token["name"], attrs)
    216. 

  216.         else:
    217. 

  217.             token["data"] = "<%s>" % token["name"]
    218. 

  218.         if token.get("selfClosing"):
    219. 

  219.             token["data"] = token["data"][:-1] + "/>"
    220. 

  220. 

  221.         if token["type"] in list(tokenTypes.keys()):
    222. 

  222.             token["type"] = "Characters"
    223. 

  223.         else:
    224. 

  224.             token["type"] = tokenTypes["Characters"]
    225. 

  225. 

  226.         del token["name"]
    227. 

  227.         return token
    228. 

  228. 

  229.     def sanitize_css(self, style):
    230. 

  230.         # disallow urls
    231. 

  231.         style = re.compile('url\s*\(\s*[^\s)]+?\s*\)\s*').sub(' ', style)
    232. 

  232. 

  233.         # gauntlet
    234. 

  234.         if not re.match("""^([:,;#%.\sa-zA-Z0-9!]|\w-\w|'[\s\w]+'|"[\s\w]+"|\([\d,\s]+\))*$""", style):
    235. 

  235.             return ''
    236. 

  236.         if not re.match("^\s*([-\w]+\s*:[^:;]*(;\s*|$))*$", style):
    237. 

  237.             return ''
    238. 

  238. 

  239.         clean = []
    240. 

  240.         for prop, value in re.findall("([-\w]+)\s*:\s*([^:;]*)", style):
    241. 

  241.             if not value:
    242. 

  242.                 continue
    243. 

  243.             if prop.lower() in self.allowed_css_properties:
    244. 

  244.                 clean.append(prop + ': ' + value + ';')
    245. 

  245.             elif prop.split('-')[0].lower() in ['background', 'border', 'margin',
    246. 

  246.                                                 'padding']:
    247. 

  247.                 for keyword in value.split():
    248. 

  248.                     if not keyword in self.acceptable_css_keywords and \
    249. 

  249.                             not re.match("^(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)$", keyword):
    250. 

  250.                         break
    251. 

  251.                 else:
    252. 

  252.                     clean.append(prop + ': ' + value + ';')
    253. 

  253.             elif prop.lower() in self.allowed_svg_properties:
    254. 

  254.                 clean.append(prop + ': ' + value + ';')
    255. 

  255. 

  256.         return ' '.join(clean)
    257. 

  257. 

  258. 

  259. class HTMLSanitizer(HTMLTokenizer, HTMLSanitizerMixin):
    260. 

  260.     def __init__(self, stream, encoding=None, parseMeta=True, useChardet=True,
    261. 

  261.                  lowercaseElementName=False, lowercaseAttrName=False, parser=None):
    262. 

  262.         # Change case matching defaults as we only output lowercase html anyway
    263. 

  263.         # This solution doesn't seem ideal...
    264. 

  264.         HTMLTokenizer.__init__(self, stream, encoding, parseMeta, useChardet,
    265. 

  265.                                lowercaseElementName, lowercaseAttrName, parser=parser)
    266. 

  266. 

  267.     def __iter__(self):
    268. 

  268.         for token in HTMLTokenizer.__iter__(self):
    269. 

  269.             token = self.sanitize_token(token)
    270. 

  270.             if token:
    271. 

  271.                 yield token
    272. 

  272.