fixing XSS vulnerability

quokka/admin/actions.py

@@ -8,7 +8,7 @@
 from flask import Response, current_app, flash, redirect, url_for
 from flask_admin.actions import action
 
-from quokka.utils.text import slugify
+from quokka.utils.text import slugify, remove_tags_from_string
 
 
 class PublishAction(object):
@@ -82,6 +82,11 @@ def action_create_userprofile(self, ids):
             existing_block = current_app.db.get(
                 'index', {'content_type': 'block', 'slug': fullslug}
             )
+
+            # fix vulnerabillity here XSS
+            user['fullname'] = remove_tags_from_string(user['fullname'])
+            user['username'] = remove_tags_from_string(user['username'])
+
             if existing_block:
                 blocklink = url_for(
                     'quokka.core.content.admin.blockview.edit_view',

quokka/admin/wtforms_html5.py

@@ -195,7 +195,7 @@ def set_title(field, render_kw=None):
     """
     if render_kw is None:
         render_kw = {}
-    if 'title' not in render_kw and getattr(field, 'description'):
+    if 'title' not in render_kw and getattr(field, 'description', None):
         render_kw['title'] = '{}'.format(field.description)
     return render_kw
 

quokka/core/content/models.py

@@ -230,13 +230,13 @@ def metadata(self):
         # TODO: get metadata from database
         # TODO: implement libratar/gravatar
         # return {
-            # 'cover': 'foo',
-            # 'author_gravatar': 'http://i.pravatar.cc/300',
-            # 'about_author': 'About Author',
-            # 'translations': ['en'],
-            # 'og_image': 'foo',
-            # 'series': 'aa',
-            # 'asides': 'aaa'
+        # 'cover': 'foo',
+        # 'author_gravatar': 'http://i.pravatar.cc/300',
+        # 'about_author': 'About Author',
+        # 'translations': ['en'],
+        # 'og_image': 'foo',
+        # 'series': 'aa',
+        # 'asides': 'aaa'
         # }
         data = {}
         data.update(custom_var_dict(self.data.get('custom_vars')))

quokka/core/content/utils.py

@@ -10,9 +10,10 @@ def url_for_content(content, include_ext=True):
     else:
         data = content
 
+    category_slug_data = data.get('category_slug')
+    category_data = slugify_category(data.get('category') or '')
     category_slug = (
-        data.get('category_slug') or
-        slugify_category(data.get('category') or '')
+        category_slug_data or category_data
     )
     slug = data.get('slug') or slugify(data.get('title'))
 

quokka/core/content/views.py

@@ -255,6 +255,8 @@ def render_rss(self, content_type, templates, **context):
 
         for content in contents:
             content = make_model(content)
+            content_data = content.title.encode('utf-8')
+            content_data += content.url.encode('utf-8')
 
             if content.date > rss_pubdate:
                 rss_pubdate = content.date
@@ -267,8 +269,7 @@ def render_rss(self, content_type, templates, **context):
                     author=str(content.author),
                     categories=[str(content.tags)],
                     guid=hashlib.sha1(
-                        content.title.encode('utf-8') +
-                        content.url.encode('utf-8')
+                        content_data
                     ).hexdigest(),
                     pubDate=content.date,
                 )

quokka/core/db.py

@@ -183,17 +183,14 @@ def page_set(self, *args, **kwargs):
         return self.content_set(*args, **kwargs)
 
     def block_set(self, *args, **kwargs):
-            kwargs.setdefault(
-                'sort',
-                self.app.theme_context.get(
-                    'BLOCK_ORDER_BY', [('title', -1)]
-                )
-            )
-            if not args:
-                args = [{'content_type': 'block'}]
-            elif isinstance(args[0], dict):
-                args[0]['content_type'] = 'block'
-            return self.content_set(*args, **kwargs)
+        kwargs.setdefault('sort', self.app.theme_context.get(
+            'BLOCK_ORDER_BY', [('title', -1)]
+        ))
+        if not args:
+            args = [{'content_type': 'block'}]
+        elif isinstance(args[0], dict):
+            args[0]['content_type'] = 'block'
+        return self.content_set(*args, **kwargs)
 
     def select(self, colname, *args, **kwargs):
         return self.get_collection(colname).find(*args, **kwargs)

quokka/core/views/sitemap.py

@@ -11,12 +11,12 @@ def get_contents(self):
         TODO: Should include extra paths, fixed paths
         config based paths, static paths
         """
+        content = self.get_index() + self.get_categories()
+        content += self.get_tags() + self.get_authors()
+        content += self.get_articles_and_pages()
+
         return (
-            self.get_index() +
-            self.get_categories() +
-            self.get_tags() +
-            self.get_authors() +
-            self.get_articles_and_pages()
+            content
         )
 
     def get_index(self):

quokka/utils/text.py

@@ -1,3 +1,4 @@
+import re
 from flask import request
 from urllib.parse import urljoin
 from slugify.main import Slugify
@@ -91,3 +92,19 @@ def split_all_category_roots(cat):
         return cats
     else:
         return [cat]
+
+
+def remove_tags_from_string(data):
+    """remove tags html, commas, semicolon
+       and double quote from string prevent XSS
+    """
+    resp = re.sub('<[^>]*>', '', data)
+    return resp.replace(
+        '"', ''
+    ).replace(
+        ';', ''
+    ).replace(
+        '(', ''
+    ).replace(
+        ')', ''
+    )

quokka/utils/upload.py

@@ -9,7 +9,7 @@
 
 def dated_path(obj, file_data):
     try:
-        prefix = getattr(obj, 'model_name')
+        prefix = getattr(obj, 'model_name', None)
     except BaseException:
         prefix = "undefined"
 

requirements-dev.txt

@@ -12,3 +12,4 @@ twine>=1.9.1
 wheel>=0.30.0
 flask>=1.0
 logzero
+pytest_mock

tests/test_basic.py

@@ -1,3 +1,155 @@
+import mock
+import quokka
+from quokka import create_app, create_app_base
+from pytest_mock import mocker
+from quokka.core.app import QuokkaApp
+from quokka.core.flask_dynaconf import configure_dynaconf
+
+
+################################
+# pytest - fixtures - setUp(); #
+################################
+class MockTestApp(object):
+
+    def __init__(self, config):
+        self.config = config
+        return self.config
+
+
+#####################################
+# pytest - Quokka - test__init__.py #
+#####################################
+def test_create_app_called_params_default(mocker):
+    mocker.patch("quokka.create_app_base")
+    mocker.patch("quokka.core.configure_extensions")
+    quokka.create_app()
+    quokka.create_app_base.assert_called_once_with(test=False)
+
+
+def test_create_app_called_test_false(mocker):
+    mocker.patch("quokka.create_app_base")
+    mocker.patch("quokka.core.configure_extensions")
+    quokka.create_app(test=False)
+    quokka.create_app_base.assert_called_once_with(test=False)
+
+
+def test_create_app_called_test_true(mocker):
+    mocker.patch("quokka.create_app_base")
+    mocker.patch("quokka.core.configure_extensions")
+    quokka.create_app(test=True)
+    quokka.create_app_base.assert_called_once_with(test=True)
+
+
+def test_create_app_called_test_true_and_settings_dict(mocker):
+    mocker.patch("quokka.create_app_base")
+    mocker.patch("quokka.core.configure_extensions")
+    quokka.create_app(test=True, settings={'a':'1', 'b':'2', 'c':'3', 'd':'4', 'e':'5'})
+    quokka.create_app_base.assert_called_once_with(test=True, settings={'a':'1', 'b':'2', 'c':'3', 'd':'4', 'e':'5'})
+
+
+@mock.patch("quokka.core.app.QuokkaApp")
+@mock.patch("quokka.core.flask_dynaconf.configure_dynaconf")
+@mock.patch("quokka.core.configure_extension")
+def test_create_app_base_function_quokkaapp_called_is_false(mock_configure_extension, mock_configure_dynaconf, mock_QuokkaApp):
+    quokka.create_app_base(test=False, ext_list=None)
+    assert mock_QuokkaApp.called is False
+
+
+@mock.patch("quokka.core.app.QuokkaApp")
+@mock.patch("quokka.core.flask_dynaconf.configure_dynaconf")
+@mock.patch("quokka.core.configure_extension")
+def test_create_app_base_function_dynaconf_called_is_false(mock_configure_extension, mock_configure_dynaconf, mock_QuokkaApp):
+    quokka.create_app_base(test=False, ext_list=None)
+    assert mock_configure_dynaconf.called is False
+
+
+@mock.patch("quokka.core.app.QuokkaApp")
+@mock.patch("quokka.core.flask_dynaconf.configure_dynaconf")
+@mock.patch("quokka.core.configure_extension")
+def test_create_app_base_function_configure_extension_called_is_false(mock_configure_extension, mock_configure_dynaconf, mock_QuokkaApp):
+    quokka.create_app_base(test=False, ext_list=None)
+    assert mock_configure_extension.called is False
+
+
+@mock.patch("quokka.core.app.QuokkaApp")
+@mock.patch("quokka.core.flask_dynaconf.configure_dynaconf")
+@mock.patch("quokka.core.configure_extension")
+def test_create_app_base_function_quokkaapp_called_is_false_and_test_true(mock_configure_extension, mock_configure_dynaconf, mock_QuokkaApp):
+    quokka.create_app_base(test=True, ext_list=[])
+    assert mock_QuokkaApp.called is False
+
+
+@mock.patch("quokka.core.app.QuokkaApp")
+@mock.patch("quokka.core.flask_dynaconf.configure_dynaconf")
+@mock.patch("quokka.core.configure_extension")
+def test_create_app_base_function_dynaconf_called_is_false_test_true_and_ext_list(mock_configure_extension, mock_configure_dynaconf, mock_QuokkaApp):
+    quokka.create_app_base(test=True, ext_list=['quokka.core.configure_extension'])
+    assert mock_configure_dynaconf.called is False
+
+
+@mock.patch("quokka.core.app.QuokkaApp")
+@mock.patch("quokka.core.flask_dynaconf.configure_dynaconf")
+@mock.patch("quokka.core.configure_extension")
+def test_create_app_base_function_configure_dynaconf_called_is_true(mock_configure_extension, mock_configure_dynaconf, mock_QuokkaApp):
+    list_ext = ['quokka.core.app.QuokkaApp', 
+                'quokka.core.flask_dynaconf.configure_dynaconf',
+                'quokka.core.configure_extension']
+    quokka.create_app_base(test=True, ext_list=list_ext)
+    assert mock_configure_dynaconf.called is True
+
+
+@mock.patch("quokka.core.app.QuokkaApp")
+@mock.patch("quokka.core.flask_dynaconf.configure_dynaconf")
+@mock.patch("quokka.core.configure_extension")
+def test_create_app_base_function_quokkaapp_called_is_true(mock_configure_extension, mock_configure_dynaconf, mock_QuokkaApp):
+    list_ext = ['quokka.core.app.QuokkaApp', 
+                'quokka.core.flask_dynaconf.configure_dynaconf',
+                'quokka.core.configure_extension']
+    quokka.create_app_base(test=True, ext_list=list_ext)
+    assert mock_QuokkaApp.called is True
+
+
+@mock.patch("quokka.core.app.QuokkaApp")
+@mock.patch("quokka.core.flask_dynaconf.configure_dynaconf")
+@mock.patch("quokka.core.configure_extension")
+def test_create_app_base_function_configure_extension_called_is_true(mock_configure_extension, mock_configure_dynaconf, mock_QuokkaApp):
+    list_ext = ['quokka.core.app.QuokkaApp', 
+                'quokka.core.flask_dynaconf.configure_dynaconf',
+                'quokka.core.configure_extension']
+    quokka.create_app_base(test=True, ext_list=list_ext)
+    assert mock_configure_extension.called is True
+
+
+@mock.patch("quokka.core.app.QuokkaApp")
+@mock.patch("quokka.core.flask_dynaconf.configure_dynaconf")
+@mock.patch("quokka.core.configure_extension")
+def test_create_app_base_function_configure_extension_called_is_true_and_settings(mock_configure_extension, mock_configure_dynaconf, mock_QuokkaApp):
+    list_ext = ['quokka.core.app.QuokkaApp', 
+                'quokka.core.flask_dynaconf.configure_dynaconf',
+                'quokka.core.configure_extension']
+    quokka.create_app_base(test=True, ext_list=list_ext, settings={'a':'1', 'b':'2', 'c':'3', 'd':'4', 'e':'5'})
+    assert mock_configure_extension.called is True
+
+
+@mock.patch("quokka.core.app.QuokkaApp")
+@mock.patch("quokka.core.flask_dynaconf.configure_dynaconf")
+@mock.patch("quokka.core.configure_extension")
+def test_create_app_base_function_configure_dynaconf_called_is_true_and_settings(mock_configure_extension, mock_configure_dynaconf, mock_QuokkaApp):
+    list_ext = ['quokka.core.app.QuokkaApp', 
+                'quokka.core.flask_dynaconf.configure_dynaconf',
+                'quokka.core.configure_extension']
+    quokka.create_app_base(test=True, ext_list=list_ext, settings={'a':'1', 'b':'2', 'c':'3', 'd':'4', 'e':'5'})
+    assert mock_configure_dynaconf.called is True
+
+
+@mock.patch("quokka.core.app.QuokkaApp")
+@mock.patch("quokka.core.flask_dynaconf.configure_dynaconf")
+@mock.patch("quokka.core.configure_extension")
+def test_create_app_base_function_quokkaapp_called_is_true_and_settings(mock_configure_extension, mock_configure_dynaconf, mock_QuokkaApp):
+    list_ext = ['quokka.core.app.QuokkaApp', 
+                'quokka.core.flask_dynaconf.configure_dynaconf',
+                'quokka.core.configure_extension']
+    quokka.create_app_base(test=True, ext_list=list_ext, settings={'a':'1', 'b':'2', 'c':'3', 'd':'4', 'e':'5'})
+    assert mock_QuokkaApp.called is True
+
 
-def test_basic(app):
-    assert app.name == 'quokka'

tests/utils/test_text.py

@@ -0,0 +1,64 @@
+import pytest
+from flask import request
+from urllib.parse import urljoin
+from slugify.main import Slugify
+from quokka.utils.text import (
+    abbreviate, normalize_var,
+    make_social_link, make_social_link,
+    make_social_name, cdata,
+    make_external_url, split_all_category_roots,
+    remove_tags_from_string
+)
+
+################################
+#pytest - fixtures - setUp();  #
+################################
+slugify = Slugify()
+slugify.to_lower = True
+slugify_category = Slugify()
+slugify_category.to_lower = True
+slugify_category.safe_chars = '/'
+abbrev = abbreviate("pytest-mock")
+norma = normalize_var("http://yahoo.com")
+make_link = make_social_link(network="twitter", txt="http://twitter.com/python")
+make_name = make_social_name('http://twitter.com/python')
+data = cdata("py-cdata")
+split = split_all_category_roots(cat="categoria1/categoria2/categoria3")
+
+
+##################################
+#pytest - Quokka - test_text.py  #
+##################################
+def test_abbreviate():
+    debugger = abbreviate("pytest-mock")
+    assert abbrev == 'pytest-mock'
+
+def test_normalize_var():
+    assert norma == "http:__yahoo.com"
+
+
+def test_make_social_link():
+    assert make_link == 'http://twitter.com/python'
+
+
+def test_make_social_name():
+    assert make_name == 'python'
+
+def test_cdata():
+    assert data == '<![CDATA[\npy-cdata\n]]>'    
+
+def test_make_external_url():
+    with pytest.raises(RuntimeError) as err:
+        make_external_url("http://it.yahoo.com")
+        assert "Working outside of application context." in str(err.value)
+
+def test_split_all_category_roots():
+    assert split[0] == 'categoria1/categoria2/categoria3'
+    assert split[1] == 'categoria1/categoria2'
+    assert split[2] == 'categoria1'
+
+def test_remove_tags_from_string():
+    assert remove_tags_from_string('<script>alert("python-quokka");</script>') == 'alertpython-quokka'
+    assert remove_tags_from_string('<script>console.log("python-quokka");</script>') == 'console.logpython-quokka'
+    assert remove_tags_from_string('<b>python-quokka</b>') == 'python-quokka'
+    assert remove_tags_from_string('<style>position:relative;top:10px;float:left;</style>') == 'position:relativetop:10pxfloat:left'