arno/isso
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

remove cgi.escape and simplify input sanitization

Browse Source 
Escaping is done in Jade templates (by default).
This commit is contained in:
Martin Zimmermann 2014-07-22 19:33:09 +02:00
parent fc2cc0c65f
commit bd1cb498d1
1 changed files with 10 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
isso/views/api.py
View File

@ -2,8 +2,6 @@
from __future__ import unicode_literals from __future__ import unicode_literals
import cgi
from functools import partial from functools import partial
from itsdangerous import SignatureExpired, BadSignature from itsdangerous import SignatureExpired, BadSignature
@ -100,24 +98,24 @@ class API(object):
return obj return obj
@xhr @classmethod
@requires(str, 'uri') def sanitize(cls, data):
def new(self, environ, request, uri):
data = request.get_json()
if not isinstance(data, dict): if not isinstance(data, dict):
raise BadRequest(400, "request data is not an object") raise BadRequest(400, "request data is not an object")
for field in set(data.keys()) - API.ACCEPT: for field in set(data.keys()) - API.ACCEPT:
data.pop(field) data.pop(field)
for field in ("author", "email", "website"):
if isinstance(data.get(field, None), string_types):
data[field] = cgi.escape(data[field])
if isinstance(data.get("website", None), string_types): if isinstance(data.get("website", None), string_types):
data["website"] = normalize(data["website"]) data["website"] = normalize(data["website"])
return data
@xhr
@requires(str, 'uri')
def new(self, environ, request, uri):
data = API.sanitize(request.get_json())
remote_addr = utils.anonymize(str(request.remote_addr)) remote_addr = utils.anonymize(str(request.remote_addr))
with self.db.transaction: with self.db.transaction:
@ -174,7 +172,7 @@ class API(object):
if rv[1] != sha1(comment.text): if rv[1] != sha1(comment.text):
raise Forbidden raise Forbidden
data = request.get_json() data = API.sanitize(request.get_json())
if not isinstance(data, dict): if not isinstance(data, dict):
raise BadRequest(400, "request data is not an object") raise BadRequest(400, "request data is not an object")