|
 |
094a9f |
diff --git a/src/lxml/html/clean.py b/src/lxml/html/clean.py
|
|
|
094a9f |
index adc3f45..6f3f7de 100644
|
|
|
094a9f |
--- a/src/lxml/html/clean.py
|
|
|
094a9f |
+++ b/src/lxml/html/clean.py
|
|
|
094a9f |
@@ -61,12 +61,15 @@ __all__ = ['clean_html', 'clean', 'Cleaner', 'autolink', 'autolink_html',
|
|
|
094a9f |
|
|
|
094a9f |
# This is an IE-specific construct you can have in a stylesheet to
|
|
|
094a9f |
# run some Javascript:
|
|
|
094a9f |
-_css_javascript_re = re.compile(
|
|
|
094a9f |
- r'expression\s*\(.*?\)', re.S|re.I)
|
|
|
094a9f |
+_replace_css_javascript = re.compile(
|
|
|
094a9f |
+ r'expression\s*\(.*?\)', re.S|re.I).sub
|
|
|
094a9f |
|
|
|
094a9f |
# Do I have to worry about @\nimport?
|
|
|
094a9f |
-_css_import_re = re.compile(
|
|
|
094a9f |
- r'@\s*import', re.I)
|
|
|
094a9f |
+_replace_css_import = re.compile(
|
|
|
094a9f |
+ r'@\s*import', re.I).sub
|
|
|
094a9f |
+
|
|
|
094a9f |
+_looks_like_tag_content = re.compile(
|
|
|
094a9f |
+ r'</?[a-zA-Z]+|\son[a-zA-Z]+\s*=', re.ASCII).search
|
|
|
094a9f |
|
|
|
094a9f |
# All kinds of schemes besides just javascript: that can cause
|
|
|
094a9f |
# execution:
|
|
|
094a9f |
@@ -292,8 +295,8 @@ class Cleaner(object):
|
|
|
094a9f |
if not self.inline_style:
|
|
|
094a9f |
for el in _find_styled_elements(doc):
|
|
|
094a9f |
old = el.get('style')
|
|
|
094a9f |
- new = _css_javascript_re.sub('', old)
|
|
|
094a9f |
- new = _css_import_re.sub('', new)
|
|
|
094a9f |
+ new = _replace_css_javascript('', old)
|
|
|
094a9f |
+ new = _replace_css_import('', new)
|
|
|
094a9f |
if self._has_sneaky_javascript(new):
|
|
|
094a9f |
# Something tricky is going on...
|
|
|
094a9f |
del el.attrib['style']
|
|
|
094a9f |
@@ -305,9 +308,9 @@ class Cleaner(object):
|
|
|
094a9f |
el.drop_tree()
|
|
|
094a9f |
continue
|
|
|
094a9f |
old = el.text or ''
|
|
|
094a9f |
- new = _css_javascript_re.sub('', old)
|
|
|
094a9f |
+ new = _replace_css_javascript('', old)
|
|
|
094a9f |
# The imported CSS can do anything; we just can't allow:
|
|
|
094a9f |
- new = _css_import_re.sub('', old)
|
|
|
094a9f |
+ new = _replace_css_import('', new)
|
|
|
094a9f |
if self._has_sneaky_javascript(new):
|
|
|
094a9f |
# Something tricky is going on...
|
|
|
094a9f |
el.text = '/* deleted */'
|
|
|
094a9f |
@@ -509,6 +512,12 @@ class Cleaner(object):
|
|
|
094a9f |
return True
|
|
|
094a9f |
if 'expression(' in style:
|
|
|
094a9f |
return True
|
|
|
094a9f |
+ if '
|
|
|
094a9f |
+ # e.g. ' ">'
|
|
|
094a9f |
+ return True
|
|
|
094a9f |
+ if _looks_like_tag_content(style):
|
|
|
094a9f |
+ # e.g. '<math><style></style></math>'
|
|
|
094a9f |
+ return True
|
|
|
094a9f |
return False
|
|
|
094a9f |
|
|
|
094a9f |
def clean_html(self, html):
|
|
|
094a9f |
diff --git a/src/lxml/html/tests/test_clean.py b/src/lxml/html/tests/test_clean.py
|
|
|
094a9f |
index 3bcaaf5..451eec2 100644
|
|
|
094a9f |
--- a/src/lxml/html/tests/test_clean.py
|
|
|
094a9f |
+++ b/src/lxml/html/tests/test_clean.py
|
|
|
094a9f |
@@ -69,6 +69,26 @@ class CleanerTest(unittest.TestCase):
|
|
|
094a9f |
s = lxml.html.fromstring('<invalid tag>child</another>')
|
|
|
094a9f |
self.assertEqual('child', clean_html(s).text_content())
|
|
|
094a9f |
|
|
|
094a9f |
+ def test_sneaky_noscript_in_style(self):
|
|
|
094a9f |
+ # This gets parsed as ..."</style>
|
|
|
094a9f |
+ # thus passing the through into the output.
|
|
|
094a9f |
+ html = '">'
|
|
|
094a9f |
+ s = lxml.html.fragment_fromstring(html)
|
|
|
094a9f |
+
|
|
|
094a9f |
+ self.assertEqual(
|
|
|
094a9f |
+ b'',
|
|
|
094a9f |
+ lxml.html.tostring(clean_html(s)))
|
|
|
094a9f |
+
|
|
|
094a9f |
+ def test_sneaky_js_in_math_style(self):
|
|
|
094a9f |
+ # This gets parsed as <math> -> <style>"..."</style>
|
|
|
094a9f |
+ # thus passing any tag/script/whatever content through into the output.
|
|
|
094a9f |
+ html = '<math><style></style></math>'
|
|
|
094a9f |
+ s = lxml.html.fragment_fromstring(html)
|
|
|
094a9f |
+
|
|
|
094a9f |
+ self.assertEqual(
|
|
|
094a9f |
+ b'<math><style>/* deleted */</style></math>',
|
|
|
094a9f |
+ lxml.html.tostring(clean_html(s)))
|
|
|
094a9f |
+
|
|
|
094a9f |
|
|
|
094a9f |
def test_suite():
|
|
|
094a9f |
suite = unittest.TestSuite()
|
|
|
094a9f |
diff --git a/src/lxml/html/tests/test_clean.txt b/src/lxml/html/tests/test_clean.txt
|
|
|
094a9f |
index c78ab4f..c901871 100644
|
|
|
094a9f |
--- a/src/lxml/html/tests/test_clean.txt
|
|
|
094a9f |
+++ b/src/lxml/html/tests/test_clean.txt
|
|
|
094a9f |
@@ -104,7 +104,11 @@
|
|
|
094a9f |
>>> print(Cleaner(page_structure=False, safe_attrs_only=False).clean_html(doc))
|
|
|
094a9f |
<html>
|
|
|
094a9f |
<head>
|
|
|
094a9f |
- <style>/* deleted */</style>
|
|
|
094a9f |
+ <style>
|
|
|
094a9f |
+ body {background-image: url()};
|
|
|
094a9f |
+ div {background-image: url()};
|
|
|
094a9f |
+ div {color: };
|
|
|
094a9f |
+ </style>
|
|
|
094a9f |
</head>
|
|
|
094a9f |
<body>
|
|
|
094a9f |
a link
|
|
|
094a9f |
@@ -168,7 +172,11 @@
|
|
|
094a9f |
<link rel="alternate" type="text/rss" src="evil-rss">
|
|
|
094a9f |
<link rel="alternate" type="text/rss" href="http://example.com">
|
|
|
094a9f |
<link rel="stylesheet" type="text/rss" href="http://example.com">
|
|
|
094a9f |
- <style>/* deleted */</style>
|
|
|
094a9f |
+ <style>
|
|
|
094a9f |
+ body {background-image: url()};
|
|
|
094a9f |
+ div {background-image: url()};
|
|
|
094a9f |
+ div {color: };
|
|
|
094a9f |
+ </style>
|
|
|
094a9f |
</head>
|
|
|
094a9f |
<body>
|
|
|
094a9f |
a link
|