'
- + (esc_html(sanitize(readme_content)) or "")
+ + (jinja_escape(sanitize(readme_content)) or "")
+ "{body}Project: {esc_html(project)}
" + f"{pre}Project: {jinja_escape(project)}
" f"{blob_html}{POSTAMBLE}" ) raise HTTPException(status_code=404, detail="Unknown object type") @@ -356,7 +356,7 @@ def git_summary(project: str, extra_rows: list[list[str]] | None = None) -> HTML board_value = f'create board' rows: list[list[str]] = [ - ["Owner", esc_html(owner) or ""], + ["Owner", jinja_escape(owner) or ""], [ ( ' ' @@ -383,12 +383,12 @@ def git_summary(project: str, extra_rows: list[list[str]] | None = None) -> HTML cols=["Field", "Value"], rows=rows, ) - pre = PREAMBLE.render(title=f"{esc_html(settings.SITE_NAME)} - {project}", site_name=settings.SITE_NAME) - body_parts = [f"{pre}{esc_html(descr)}
") + body_parts.append(f"{jinja_escape(descr)}
") body_parts.append(table) - body_parts.append(f'No remotes configured.
{POSTAMBLE}") rows = [] for r in remotes: - name = esc_html(r["name"]) - url = esc_html(r["url"] or "—") - push_url = esc_html(r["push_url"] or "—") + name = jinja_escape(r["name"]) + url = jinja_escape(r["url"] or "—") + push_url = jinja_escape(r["push_url"] or "—") rows.append([name, url, push_url]) table = env.get_template("table.html").render( cols=["Name", "URL", "Push URL"], rows=rows, ) - pre = PREAMBLE.render(title=f"Remotes - {esc_html(project)}", site_name=settings.SITE_NAME) + pre = PREAMBLE.render(title=f"Remotes - {project}", site_name=settings.SITE_NAME) return HTMLResponse(f"{pre}{body}Project: {esc_html(project)}
" + f"Project: {jinja_escape(project)}
" f"{table}{pagination_html}{POSTAMBLE}" ) @@ -588,18 +588,20 @@ def git_heads(project: str) -> HTMLResponse: commit_link = f"/project/{project}?a=commit&h={quote(oid, safe='')}" tree_link = f"/project/{project}?a=tree&h={quote(oid, safe='')}" rows.append([ - f'{esc_html(name)}', - f'{esc_html(oid_short)}', + f'{jinja_escape(name)}', + f'{jinja_escape(oid_short)}', f'tree', ]) - title = f"Heads - {esc_html(project)}" + title = f"Heads - {jinja_escape(project)}" pre = PREAMBLE.render(title=title, site_name=settings.SITE_NAME) table = env.get_template("table.html").render( cols=["Head", "Commit", ""], rows=rows, ) return HTMLResponse( - f"{pre}Project: {esc_html(project)}
{table}{POSTAMBLE}" + f"{pre}Project: {jinja_escape(project)}
{table}" + + POSTAMBLE ) @@ -637,12 +639,14 @@ def git_tags(project: str, request: Request, page: int, pagecount: int) -> HTMLR target_link = f"/project/{project}?a=tree&h={quote(target_oid, safe='')}" else: target_link = None - obj_cell = f'{esc_html(target_short)}' if target_link else esc_html(target_short) + obj_cell = ( + f'{jinja_escape(target_short)}' if target_link else jinja_escape(target_short) + ) rows.append([ - f'{esc_html(name)}', + f'{jinja_escape(name)}', obj_cell, ]) - title = f"Tags - {esc_html(project)}" + title = f"Tags - {jinja_escape(project)}" pre = PREAMBLE.render(title=title, site_name=settings.SITE_NAME) table = env.get_template("table.html").render( cols=["Tag", "Object"], @@ -653,7 +657,7 @@ def git_tags(project: str, request: Request, page: int, pagecount: int) -> HTMLR ) return HTMLResponse( f"{pre}Project: {esc_html(project)}
" + f"Project: {jinja_escape(project)}
" f"{table}{pagination_html}{POSTAMBLE}" ) @@ -691,26 +695,28 @@ def git_tag(project: str, h: str | None) -> HTMLResponse: target_short = target_oid[:7] if target_oid else "" if target_type == "commit": object_link = ( - f'{esc_html(target_short)}' + f'{jinja_escape(target_short)}' ) elif target_type == "tree": - object_link = f'{esc_html(target_short)}' + object_link = ( + f'{jinja_escape(target_short)}' + ) else: - object_link = esc_html(target_short) or "" + object_link = jinja_escape(target_short) or "" table_rows = [ - ["Tag", esc_html(tag_name)], - ["Object", f"{object_link} ({esc_html(target_type)})"], - ["Tagger", esc_html(tagger)], - ["Date", esc_html(_format_date(tagger_epoch, tagger_tz))], + ["Tag", jinja_escape(tag_name)], + ["Object", f"{object_link} ({jinja_escape(target_type)})"], + ["Tagger", jinja_escape(tagger)], + ["Date", jinja_escape(_format_date(tagger_epoch, tagger_tz))], ] if message: - table_rows.append(["Message", f""]) + table_rows.append(["Message", f""]) table = env.get_template("table.html").render(cols=["Field", "Value"], rows=table_rows) - title = f"Tag {esc_html(tag_name)} - {esc_html(project)}" + title = f"Tag {jinja_escape(tag_name)} - {jinja_escape(project)}" pre = PREAMBLE.render(title=title, site_name=settings.SITE_NAME) return HTMLResponse( - f"{pre}Project: {esc_html(project)}
" + f"{pre}Project: {jinja_escape(project)}
" f"{table}{POSTAMBLE}" ) @@ -742,26 +748,26 @@ def git_commit(project: str, h: str | None) -> HTMLResponse: diff_link = f"/project/{project}?a=commitdiff&h={quote(oid, safe='')}" patch_link = f"/project/{project}?a=patch&h={quote(oid, safe='')}" table_rows = [ - ["commit", f'{esc_html(oid)}'], - ["Author", f"{esc_html(author)} <{esc_html(author_email)}>"], - ["Date", esc_html(author_date)], - ["tree", f'{esc_html(tree_oid[:7])}'], + ["commit", f'{jinja_escape(oid)}'], + ["Author", f"{jinja_escape(author)} <{jinja_escape(author_email)}>"], + ["Date", jinja_escape(author_date)], + ["tree", f'{jinja_escape(tree_oid[:7])}'], ] for i, parent_id in enumerate(commit.parent_ids): parent_oid = str(parent_id) parent_short = parent_oid[:7] parent_link = f"/project/{project}?a=commit&h={quote(parent_oid, safe='')}" label = "parent" if len(commit.parent_ids) == 1 else f"parent ({i + 1})" - table_rows.append([label, f'{esc_html(parent_short)}']) + table_rows.append([label, f'{jinja_escape(parent_short)}']) if message: - table_rows.append(["", f""]) + table_rows.append(["", f""]) table_rows.append(["", f'diff · patch']) table = env.get_template("table.html").render(cols=["Field", "Value"], rows=table_rows) - title = f"Commit {esc_html(oid_short)} - {esc_html(project)}" + title = f"Commit {jinja_escape(oid_short)} - {jinja_escape(project)}" pre = PREAMBLE.render(title=title, site_name=settings.SITE_NAME) return HTMLResponse( - f"{pre}Project: {esc_html(project)}
" + f"{pre}Project: {jinja_escape(project)}
" f"{table}{POSTAMBLE}" ) @@ -846,7 +852,7 @@ def git_blobdiff( diff_b64 = base64.b64encode(diff_text.encode("utf-8")).decode("ascii") blob_link = f"/project/{project}?a=blob&h={quote(h or '', safe='')}&f={quote(path_new, safe='/')}" pre = PREAMBLE.render( - title=f"Blob diff - {esc_html(path_new)} - {esc_html(project)}", + title=f"Blob diff - {jinja_escape(path_new)} - {jinja_escape(project)}", site_name=settings.SITE_NAME, ) body = env.get_template("blobdiff.html").render( diff --git a/pygitweb/formatting.py b/pygitweb/formatting.py index ddbca09..2d0cff1 100644 --- a/pygitweb/formatting.py +++ b/pygitweb/formatting.py @@ -1,6 +1,6 @@ """ -Formatting: escaping (esc_param, esc_path_info, esc_url, esc_attr, esc_html, esc_path, sanitize), -quot_cec, quot_upr, unquote, untabify, to_utf8, chop_str, chop_and_escape_str, age_class, age_string. +Formatting: escaping (esc_param, esc_path_info, esc_url, esc_path, sanitize), +quot_cec, quot_upr, unquote, untabify, to_utf8, age_class, age_string. Ported from gitweb/gitweb.perl. """ @@ -61,20 +61,6 @@ def esc_url(s: str | None) -> str | None: return quote(s, safe="-_.~()/:@!") -def esc_attr(s: str | None) -> str | None: - """Escape for HTML attribute. Port of esc_attr.""" - if s is None: - return None - return html.escape(s, quote=True) - - -def esc_html(s: str | None) -> str | None: - """Escape for HTML body. Port of esc_html.""" - if s is None: - return None - return html.escape(s, quote=False) - - def quot_cec(char: str, nohtml: bool = False) -> str: """Printable representation of control char (CEC). Port of quot_cec.""" out = _CEC_MAP.get(char, f"\\{ord(char):02x}") @@ -166,71 +152,6 @@ def untabify(line: str, tabwidth: int = 8) -> str: return "".join(result) -def chop_str( - s: str, - length: int, - add_len: int = 10, - where: str = "right", -) -> str: - """Chop on word boundary between length and length+add_len. Port of chop_str.""" - s = to_utf8(s) or "" - if where == "center": - if length + 5 >= len(s): - return s - half = length // 2 - endre = re.compile(rf".{{{half}}}\w{{0,{add_len}}}", re.DOTALL) - begre = re.compile(rf"\w{{0,{add_len}}}.{{{half}}}$", re.DOTALL) - m1 = re.match(rf"^(.{{{half}}}\w{{0,{add_len}}})(.*)$", s, re.DOTALL) - if not m1: - return s[: length // 2] + " ... " + s[-(length // 2) :] - left, rest = m1.group(1), m1.group(2) - m2 = re.match(rf"^(.*?)(\w{{0,{add_len}}}.{{{half}}})$", rest, re.DOTALL) - if not m2: - return left + " ... " + rest[-half:] - mid, right = m2.group(1), m2.group(2) - if len(mid) > 5: - mid = " ... " - return left + mid + right - if length + 4 >= len(s): - return s - if where == "left": - begre = re.compile(rf"\w{{0,{add_len}}}.{{{length}}}$") - m = begre.search(s) - if m: - body = m.group(0) - lead = s[: m.start()] - if len(lead) > 4: - lead = " ..." - return lead + body - return s - # right - endre = re.compile(rf".{{{length}}}\w{{0,{add_len}}}") - m = endre.match(s) - if m: - body = m.group(0) - tail = s[m.end() :] - if len(tail) > 4: - tail = "... " - return body + tail - return s - - -def chop_and_escape_str( - s: str, - length: int, - add_len: int = 10, - where: str = "right", -) -> str: - """Chop then HTML-escape; wrap in span with title if chopped. Port of chop_and_escape_str.""" - chopped = chop_str(s, length, add_len, where) - s = to_utf8(s) or s - if chopped == s: - return esc_html(chopped) or "" - title = esc_attr(s.replace("\n", " ").replace("\r", "?")) - escaped = esc_html(chopped) or "" - return f'{escaped}' - - def age_class(age_seconds: float | None) -> str: """CSS class for age. Port of age_class.""" if age_seconds is None: diff --git a/pygitweb/main.py b/pygitweb/main.py index 93738e2..b50b3ef 100644 --- a/pygitweb/main.py +++ b/pygitweb/main.py @@ -43,7 +43,7 @@ from pygitweb.api.plugins.project_zip import ProjectZip from pygitweb.api.project import Project from pygitweb.api.subpage import Subpage from pygitweb.config import ACTIONS, get_loadavg, settings -from pygitweb.formatting import age_string, esc_html +from pygitweb.formatting import age_string from pygitweb.git_helpers import git_get_references, git_get_type from pygitweb.projects import git_get_project_owner, git_get_projects_list from pygitweb.settings import router as settings_router @@ -54,7 +54,7 @@ from pygitweb.tasks import ( get_board_tasks_grouped, task_router, ) -from pygitweb.templates_env import POSTAMBLE, PREAMBLE, env +from pygitweb.templates_env import POSTAMBLE, PREAMBLE, env, jinja_escape from pygitweb.timeline_cache import get_all_timeline_events, warm_timeline_cache_async from pygitweb.validation import is_valid_pathname, is_valid_project @@ -181,7 +181,7 @@ def _project_subpage_rows(project: str) -> list[list[str]]: continue subpage_name = subpage.subpage_name() rows.append([ - esc_html(link_label), + jinja_escape(link_label) or "", f'view', ]) return rows @@ -230,14 +230,14 @@ def git_project_list( cols=["Project", "Description", "Board"], rows=[ [ - f"{esc_html(pr.get('path', ''))}", - esc_html(pr.get("descr") or pr.get("path", "")), + f"{jinja_escape(pr.get('path', ''))}", + jinja_escape(pr.get("descr") or pr.get("path", "")), board_cell(pr), ] for pr in list_[:50] ], ) - pre = PREAMBLE.render(title=f"{esc_html(settings.SITE_NAME)} - Projects", site_name=settings.SITE_NAME) + pre = PREAMBLE.render(title=f"{settings.SITE_NAME} - Projects", site_name=settings.SITE_NAME) return HTMLResponse(f"{pre}Action: {esc_html(action)}
Project: {esc_html(project)}
{POSTAMBLE}") + pre = PREAMBLE.render(title=f"{action} - {project}", site_name=settings.SITE_NAME) + return HTMLResponse(f"{pre}Action: {jinja_escape(action)}
Project: {jinja_escape(project)}
{POSTAMBLE}") if __name__ == "__main__": diff --git a/pygitweb/settings.py b/pygitweb/settings.py index a6b88a5..ce73793 100644 --- a/pygitweb/settings.py +++ b/pygitweb/settings.py @@ -14,10 +14,9 @@ from fastapi import APIRouter, HTTPException, Request from fastapi.responses import HTMLResponse, RedirectResponse from pygitweb.config import settings -from pygitweb.formatting import esc_html from pygitweb.git_helpers import open_repo from pygitweb.projects import git_get_projects_list -from pygitweb.templates_env import POSTAMBLE, PREAMBLE, env +from pygitweb.templates_env import POSTAMBLE, PREAMBLE, env, jinja_escape from pygitweb.validation import is_valid_project @@ -56,7 +55,6 @@ def _render_form_field(name: str, value: Any, value_type: type, docstring: str, """Generate HTML for a single form field based on type.""" field_name = f"{name_prefix}{name}" if name_prefix else name safe_name = field_name.replace(".", "_") - hint = f'{esc_html(docstring)}' tpl = env.get_template("settings_form_field.html") if value_type is bool: return tpl.render( @@ -64,8 +62,8 @@ def _render_form_field(name: str, value: Any, value_type: type, docstring: str, safe_name=safe_name, field_name=field_name, name=name, - checked_attr=" checked" if value else "", - hint=hint, + checked=bool(value), + hint_text=docstring, ) if value_type in (int, float): raw = "" if value is None else str(value) @@ -74,8 +72,8 @@ def _render_form_field(name: str, value: Any, value_type: type, docstring: str, safe_name=safe_name, field_name=field_name, name=name, - str_val=esc_html(raw) or "", - hint=hint, + str_val=raw, + hint_text=docstring, number_step="any", ) raw = "" if value is None else str(value) @@ -84,8 +82,8 @@ def _render_form_field(name: str, value: Any, value_type: type, docstring: str, safe_name=safe_name, field_name=field_name, name=name, - str_val=esc_html(raw) or "", - hint=hint, + str_val=raw, + hint_text=docstring, ) @@ -201,7 +199,6 @@ def _render_pygit2_field(name: str, value: Any, kind: str, docstring: str, name_ """Generate HTML for a PyGit2 form field.""" field_name = f"{name_prefix}{name}" safe_name = field_name.replace(".", "_") - hint = f'{esc_html(docstring)}' tpl = env.get_template("settings_form_field.html") if kind == "readonly": raw = str(value) if value != "" else "(not set)" @@ -210,8 +207,8 @@ def _render_pygit2_field(name: str, value: Any, kind: str, docstring: str, name_ safe_name=safe_name, field_name=field_name, name=name, - str_val=esc_html(raw) or "", - hint=hint, + str_val=raw, + hint_text=docstring, ) if kind == "bool": checked_attr = ( @@ -224,8 +221,8 @@ def _render_pygit2_field(name: str, value: Any, kind: str, docstring: str, name_ safe_name=safe_name, field_name=field_name, name=name, - checked_attr=checked_attr, - hint=hint, + checked=(checked_attr != ""), + hint_text=docstring, ) if kind == "int": raw = str(value) if value != "" and value is not None else "" @@ -234,8 +231,8 @@ def _render_pygit2_field(name: str, value: Any, kind: str, docstring: str, name_ safe_name=safe_name, field_name=field_name, name=name, - str_val=esc_html(raw) or "", - hint=hint, + str_val=raw, + hint_text=docstring, ) raw = str(value) if value is not None else "" return tpl.render( @@ -243,8 +240,8 @@ def _render_pygit2_field(name: str, value: Any, kind: str, docstring: str, name_ safe_name=safe_name, field_name=field_name, name=name, - str_val=esc_html(raw) or "", - hint=hint, + str_val=raw, + hint_text=docstring, ) @@ -272,12 +269,12 @@ def _project_config_table_row(key: str, value: str, index: int) -> list[str]: key_cell = ( '' + f'value="{jinja_escape(key)}" placeholder="e.g. user.name">' ) val_cell = ( '' + f'value="{jinja_escape(value)}" placeholder="value">' ) return [key_cell, val_cell] @@ -394,15 +391,15 @@ def settings_project_page(request: Request, name: str): rows.append(_project_config_table_row("", "", len(entries))) table_html = env.get_template("table.html").render(cols=["Key", "Value"], rows=rows) pre = PREAMBLE.render( - title=f"{settings.SITE_NAME} - Project settings: {esc_html(project)}", + title=f"{settings.SITE_NAME} - Project settings: {project}", site_name=settings.SITE_NAME, ) submit_url = f"/settings/project/{_quote_path(project)}/submit" cancel_url = f"/project/{_quote_path(project)}" body = env.get_template("project_settings.html").render( - project_title=esc_html(project), - submit_url=esc_html(submit_url), - cancel_url=esc_html(cancel_url), + project_title=project, + submit_url=submit_url, + cancel_url=cancel_url, table_html=table_html, ) return HTMLResponse(f"{pre}{body}{POSTAMBLE}") diff --git a/pygitweb/templates/project_settings.html b/pygitweb/templates/project_settings.html index ce932ce..26bdb64 100644 --- a/pygitweb/templates/project_settings.html +++ b/pygitweb/templates/project_settings.html @@ -1,12 +1,12 @@ -Repository config (local and worktree only).