Dashboard
PHP:
8.2.30
OS:
Linux
User:
dh_nv8b2m
/
/
usr
/
lib
/
python3
/
dist-packages
/
trac
/
util
/
__pycache__
📤 Upload
📝 New File
📁 New Folder
Close
Editing: html.cpython-310.pyc
o ��eZ� � @ s� d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZm Z zd dlm Z W n e y7 d dlm Z Y nw zd dlmZ W n e yK dZY nw d dlmZ d d lmZ g d �Zej�� Zd ed < d]dd�Z dd� Ze�d�Zd^dd�Zdd� Z dZ dZ dZ e d_i dd�d d�d d�d d�d d�d d�d!d�d"d�d#d�d$d�d%d�d&d�d'd�d(d�d)d�d*d�d+d�d,d�d-d�d.d�d/d�d0e �d1e �d2e �d3e �d4e ��Z!de!d5< d6d7� Z"d8d9� Z#d:d;� Z$G d<d=� d=e%�Z&G d>d?� d?e&�Z'G d@dA� dAe'�Z(G dBdC� dCe%�Z)e)� Z*G dDdE� dEe)�Z+e+� Z,ZG dFdG� dGe%�Z-G dHdI� dIe%�Z.G dJdK� dKe�Z/G dLdM� dMe/�Z0G dNdO� dOe/�Z1d]dPdQ�Z2d`dRdS�Z3dadTdU�Z4dVdW� Z5e6dXdY� e7dZ�D ��Z8d[d\� Z9dS )b� N)�entities)� HTMLParser)�Markup�escape)�soft_str)� soft_unicode)� LazyProxy)� TracError)� to_unicode)� Deuglifier�FormTokenInjector�TracHTMLSanitizerr � find_element�html�is_safe_origin� plaintext�tag� to_fragment� stripentities� striptags�valid_html_bytes�unescape�' �aposTc C st t | t�r| S t | t�rt| �S t| �}|r&d|vr |S tt|��dd��S d|vr,|S tt|��dd��dd��S )a3 Create a Markup instance from a string and escape special characters it may contain (<, >, & and "). :param text: the string to escape; if not a string, it is assumed that the input can be converted to a string :param quotes: if ``True``, double quote characters are escaped in addition to the other special characters >>> escape('"1 < 2"') Markup('"1 < 2"') >>> escape(['"1 < 2"']) Markup("['"1 < 2"']") If the `quotes` parameter is set to `False`, the " character is left as is. Escaping quotes is generally only required for strings that are to be used in attribute values. >>> escape('"1 < 2"', quotes=False) Markup('"1 < 2"') >>> escape(['"1 < 2"'], quotes=False) Markup('[\'"1 < 2"\']') However, `escape` behaves slightly differently with `Markup` and `Fragment` behave instances, as they are passed through unmodified. >>> escape(Markup('"1 < 2 '"')) Markup('"1 < 2 '"') >>> escape(Markup('"1 < 2 '"'), quotes=False) Markup('"1 < 2 '"') >>> escape(tag.b('"1 < 2"')) Markup('<b>"1 < 2"</b>') >>> escape(tag.b('"1 < 2"'), quotes=False) Markup('<b>"1 < 2"</b>') :return: the escaped `Markup` string :rtype: `Markup` z'�'zz"�")� isinstancer �Fragment� escape_quotes�str�replace)�text�quotes�e� r$ �0/usr/lib/python3/dist-packages/trac/util/html.pyr 3 s - r c C s | sdS t | t�s | S | �� S )aW Reverse-escapes &, <, >, and " and returns a `str` object. >>> unescape(Markup('1 < 2')) '1 < 2' If the provided `text` object is not a `Markup` instance, it is returned unchanged. >>> unescape('1 < 2') '1 < 2' :param text: the text to unescape :return: the unescsaped string :rtype: `str` � )r r r �r! r$ r$ r% r n s r z-&(?:#((?:\d+)|(?:[xX][0-9a-fA-F]+));?|(\w+);)Fc s* � fdd�}t | t�rt| �} t�|| �S )u� Return a copy of the given text with any character or numeric entities replaced by the equivalent UTF-8 characters. >>> stripentities('1 < 2') '1 < 2' >>> stripentities('more …') 'more …' >>> stripentities('…') '…' >>> stripentities('…') '…' >>> stripentities(Markup('…')) '…' If the `keepxmlentities` parameter is provided and is a truth value, the core XML entities (&, ', >, < and ") are left intact. >>> stripentities('1 < 2 …', keepxmlentities=True) '1 < 2 …' :return: a `str` instance with entities removed :rtype: `str` c s� | � d�r%| � d�}|�d�r t|dd � d�}t|�S t|d�}t|�S | � d�}� r4|dv r4d| S ztt| �W S tyN � rJd| Y S | Y S w ) N� )�x�X� � � )�ampr �gt�lt�quotz&%s;z&%s;)�group� startswith�int�chr�_name2codepoint�KeyError)�match�ref��keepxmlentitiesr$ r% �_replace_entity� s" � �z&stripentities.<locals>._replace_entity)r r r �_STRIPENTITIES_RE�sub)r! r; r< r$ r: r% r � s r c C s t | ��� S )a� Return a copy of the text with any XML/HTML tags removed. >>> striptags('<span>Foo</span> bar') 'Foo bar' >>> striptags('<span class="bar">Foo</span>') 'Foo' >>> striptags('Foo<br />') 'Foo' HTML/XML comments are stripped, too: >>> striptags('<!-- <blub>hehe</blah> -->test') 'test' :param text: the string to remove tags from :return: a `str` instance with all tags removed :rtype: `str` )r r r' r$ r$ r% r � s r )�no�yes)�off�on)�false�true� autofocus�autoplay�checked�controls�default�defer�disabled�formnovalidate�hidden�ismap�loop�multiple�muted� novalidate�open�readonly�required�reversed�scoped�seamless�selected�contenteditable� draggable� spellcheck� translate� autocomplete�asyncc C s� | dkr t |t�rtdi |��pd}n<t |t�r t|� p d}n0| dkr6t |t�r/t|� p-d}n t|�p4d}n| tv rOt| }|du rI|rF| nd}n|t|� }|du rUdS t|�S )aj Returns the actual value for the attribute ``key``, for the given ``value``. This follows the rules described in the HTML5_ spec (Double-quoted attribute value syntax). .. _HTML5: https://www.w3.org/TR/html-markup/global-attributes.html#global-attributes In addition, it treats the ``'class'`` and the ``'style'`` attributes in a special way, as it processes them through `classes` and `styles`. :rtype: a `Markup` object containing the escaped attribute value, but it can also be `None` to indicate that the attribute should be omitted from the output �classN�styler$ )r �dict�classes�list�styles�SPECIAL_HTML_ATTRS�boolr )�key�val�valuesr$ r$ r% �html_attribute� s � rk c s4 t td| ��}|�� fdd�t� �D �� d�|�S )ai Helper function for dynamically assembling a list of CSS class names in templates. Any positional arguments are added to the list of class names. All positional arguments must be strings: >>> classes('foo', 'bar') 'foo bar' In addition, the names of any supplied keyword arguments are added if they have a truth value: >>> classes('foo', bar=True) 'foo bar' >>> classes('foo', bar=False) 'foo' >>> classes(foo=True, bar=True) 'bar foo' If none of the arguments are added to the list, this function returns `''`: >>> classes(bar=False) '' Nc 3 s � | ] }� | r|V qd S �Nr$ )�.0�k��kwargsr$ r% � <genexpr> s � zclasses.<locals>.<genexpr>� )rd �filter�extend�sorted�join)�argsrp rc r$ ro r% rc s rc c O sp i }g }t d| �D ]}t|t�r|�|� q |�|� q |�|� |�dd� t|�� dd� d�D �� d�|�S )a� Helper function for dynamically assembling a list of CSS style name and values in templates. Any positional arguments are added to the list of styles. All positional arguments must be strings or dicts: >>> styles('foo: bar', 'fu: baz', {'bottom-right': '1em'}) 'foo: bar; fu: baz; bottom-right: 1em' In addition, the names of any supplied keyword arguments are added if they have a string value: >>> styles('foo: bar', fu='baz') 'foo: bar; fu: baz' >>> styles('foo: bar', bar=False) 'foo: bar' If none of the arguments are added to the list, this function returns `''`: >>> styles(bar=False) '' Nc s s$ � | ] \}}|rd ||f V qdS )z%s: %sNr$ )rm rn �vr$ r$ r% rq D s � �zstyles.<locals>.<genexpr>c S s | d S )Nr r$ )�ir$ r$ r% �<lambda>E s zstyles.<locals>.<lambda>)rh �; ) rs r rb �update�appendrt ru �itemsrv )rw rp �dre �argr$ r$ r% re # s � re c @ sL e Zd ZdZdZdd� Zdd� Zdd� Zd d � Zd d � Z d d� Z dd� Z dS )r z8A fragment represents a sequence of strings or elements.)�childrenc G s g | _ |D ]}| �|� qd S rl )r� r} ��selfrw r� r$ r$ r% �__init__O s �zFragment.__init__c C s t t| ��S rl )r r �r� r$ r$ r% �__html__T s zFragment.__html__c C � d� dd� | jD ��S )Nr& c s s � | ]}t |d �V qdS )FN�r �rm �cr$ r$ r% rq X s � z#Fragment.__str__.<locals>.<genexpr>�rv r� r� r$ r$ r% �__str__W � zFragment.__str__c C s t | |�S rl �r )r� �otherr$ r$ r% �__add__Z � zFragment.__add__c G s |D ]}| � |� q| S rl )r} r� r$ r$ r% �__call__] s zFragment.__call__c C s� |r2t |tttttf�r| j�|� d S z |D ]}| �|� qW d S ty1 | j�|� Y d S w |dkr>| j�d� d S d S )Nr �0) r r r �bytesr4 �floatr� r} � TypeError)r� r� �eltr$ r$ r% r} b s � ��zFragment.appendc C r� )Nr& c s s* � | ]}t |t�r |�� nt|�V qd S rl )r r �as_textr r� r$ r$ r% rq q s � "�z#Fragment.as_text.<locals>.<genexpr>r� r� r$ r$ r% r� p s �zFragment.as_textN) �__name__� __module__� __qualname__�__doc__� __slots__r� r� r� r� r� r} r� r$ r$ r$ r% r J s r c @ sH e Zd ZdZdZi ZdZdZdd� Zdd� Z d d � Z d d � Z d d� Z dS )� XMLElementzXAn element represents an XML element, with a tag name, attributes and content. )r �attribr$ z/>c O s< t j| g|�R � t|�| _|r| �|�| _d S | j| _d S rl )r r� r r �_dict_from_kwargs� EMPTY_ATTRIBr� )r� r rw rp r$ r$ r% r� � s ��zXMLElement.__init__c C s |S rl r$ �r� rn rx r$ r$ r% � _attr_value� � zXMLElement._attr_valuec C sh g }|� � D ])\}}|d ur/|dd � dkr |d d� }| �||�}|d ur/|�|t|�f� qt|�S )N����_)r~ r� r} r rb )r� rp �attrsrn rx r$ r$ r% r� � s �z XMLElement._dict_from_kwargsc O sD |r| � |�}|r| jr| j�|� n|| _|D ]}| �|� q| S rl )r� r� r| r} )r� rw rp r r� r$ r$ r% r� � s zXMLElement.__call__c C s� d| j }| jr+g }t| j�D ]}| j| }|r!|�d||f � q|r+|d�|�7 }| js7| jrI| j | jvrI|dt�| � d | j d 7 }|S || j 7 }|S )N�<� %s="%s"r& �>�</) r r� ru r} rv r� � VOID_ELEMENTSr r� � CLOSE_TAG)r� r� r� rn rx r$ r$ r% r� � s � �zXMLElement.__str__N) r� r� r� r� r� r� r� r� r� r� r� r� r� r$ r$ r$ r% r� u s r� c @ s( e Zd ZdZh d�ZdZdZdd� ZdS )�Elementz�An element represents an HTML element, with a tag name, attributes and content. Some elements and attributes are rendered specially, according to the HTML5 specification (or going there...) > �br�hr�col�img�wbr�area�base�link�meta�embed�input�param�track�keygen�source�commandz />r$ c C s t ||�S rl )rk r� r$ r$ r% r� � r� zElement._attr_valueN)r� r� r� r� r� r� r� r� r$ r$ r$ r% r� � s r� c @ � e Zd ZdZdd� Zdd� ZdS )�XMLElementFactoryzhAn XML element factory can be used to build Fragments and XMLElements for arbitrary tag names. c G s t |� S rl r� )r� rw r$ r$ r% r� � � zXMLElementFactory.__call__c C � t |�S rl )r� �r� r r$ r$ r% � __getattr__� r� z XMLElementFactory.__getattr__N)r� r� r� r� r� r� r$ r$ r$ r% r� � s r� c @ s e Zd ZdZdd� ZdS )�ElementFactoryzaAn element factory can be used to build Fragments and Elements for arbitrary tag names. c C r� rl )r� r� r$ r$ r% r� � r� zElementFactory.__getattr__N)r� r� r� r� r� r$ r$ r$ r% r� � s r� c @ s� e Zd ZdZeg d��Zeg d��Zeg d��Zeg d��Zeg d��Z edg�Z eeeee e fdd �Z e � d �jZe � d �jZd d � Zdd� Zdd� Zdd� Zdd� Zdd� Ze � d�jZe � de j�jZdd� Z d d � Z e � d �jZ d d � Z d!S )"r a� Sanitize HTML constructions which are potentially vector of phishing or XSS attacks, in user-supplied HTML. The usual way to use the sanitizer is to call the `sanitize` method on some potentially unsafe HTML content. See also `genshi.HTMLSanitizer`_ from which the TracHTMLSanitizer has evolved. .. _genshi.HTMLSanitizer: http://genshi.edgewall.org/wiki/Documentation/filters.html#html-sanitizer )G�a�abbr�acronym�addressr� �b�big� blockquoter� �button�caption�center�cite�coder� �colgroup�dd�del�dfn�dir�div�dl�dt�em�fieldset�font�form�h1�h2�h3�h4�h5�h6r� ry r� r� �ins�kbd�label�legend�li�map�menu�ol�optgroup�option�p�pre�q�s�samp�select�small�span�strike�strongr> �sup�table�tbody�td�textarea�tfoot�th�thead�tr�tt�u�ul�var)Ir� �acceptzaccept-charset� accesskey�action�align�alt�axis�bgcolor�border� cellpadding� cellspacing�char�charoff�charsetrG r� r` �clear�cols�colspan�color�compact�coords�datetimer� rK �enctype�for�frame�headers�height�href�hreflang�hspace�idrN r� �lang�longdesc� maxlength�media�methodrP �name�nohref�noshade�nowrap�promptrT �rel�rev�rows�rowspan�rules�scoperY �shape�sizer� �src�startra �summary�tabindex�target�title�type�usemap�valign�value�vspace�width)e� backgroundzbackground-attachmentzbackground-colorzbackground-imagezbackground-positionzbackground-repeatr z border-bottomzborder-bottom-colorzborder-bottom-stylezborder-bottom-left-radiuszborder-bottom-right-radiuszborder-bottom-widthzborder-collapsez border-colorz border-leftzborder-left-colorzborder-left-stylezborder-left-widthz border-radiusz border-rightzborder-right-colorzborder-right-stylezborder-right-widthzborder-spacingz border-stylez border-topzborder-top-colorzborder-top-left-radiuszborder-top-right-radiuszborder-top-stylezborder-top-widthz border-width�bottomz caption-sider �clipr �contentzcounter-incrementz counter-reset�cursor� direction�displayz empty-cellsr� r� z font-familyz font-sizez font-stylez font-variantz font-weightr �leftzletter-spacingz line-heightz list-stylezlist-style-imagezlist-style-positionzlist-style-type�marginz margin-bottomz margin-leftz margin-rightz margin-topz max-heightz max-widthz min-heightz min-width�opacity�orphans�outlinez outline-colorz outline-stylez outline-width�overflow�paddingzpadding-bottomz padding-leftz padding-rightz padding-topzpage-break-afterzpage-break-beforezpage-break-inside�positionr" �rightz table-layoutz text-alignztext-decorationz text-indentztext-transform�topz unicode-bidizvertical-align� visibilityz white-space�widowsr? z word-spacingzz-index)�file�ftp�http�https�mailtoN)r r@ �dynsrcr �lowsrcr4 zdata:c C s( || _ || _|| _|| _|| _|| _dS )zyNote: safe_schemes and safe_css have to remain the first parameters, for backward-compatibility purpose. N)� safe_tags� safe_attrs�safe_css� uri_attrs� safe_schemes� safe_origins)r� r^ r\ rZ r[ r] r_ r$ r$ r% r� 3 s zTracHTMLSanitizer.__init__uc [eEＥｅ][xXＸｘ][pPＰｐ][rRʀＲｒ][eEＥｅ][sSＳｓ]{2}[iIɪＩｉ][oOＯｏ][nNɴＮｎ]u [Uu][Rrʀ][Llʟ]\s*\(([^)]+)c C s. t | t�� �}|�|� |�� t|j�� �S )z�Transforms the incoming HTML by removing anything's that deemed unsafe. :param html: the input HTML :type: str :return: the sanitized content :rtype: Markup )�HTMLSanitization�io�StringIO�feed�closer �out�getvalue)r� r � transformr$ r$ r% �sanitized s zTracHTMLSanitizer.sanitizec C s8 || j vrdS |dkr|�� dkS |�d�rd|vS dS )z|Determine whether the given css property declaration is to be considered safe for inclusion in the output. FrN �staticrH �-T)r\ �lowerr3 )r� �propr= r$ r$ r% � is_safe_csss s z TracHTMLSanitizer.is_safe_cssc C s& || j vrdS |dkrd|v rdS dS )aO Determine whether the given element should be considered safe for inclusion in the output. :param tag: the tag name of the element :type tag: str :param attrs: the element attributes :type attrs: list :return: whether the element should be considered safe :rtype: bool Fr� )r: �passwordT)rZ �r� r r� r$ r$ r% � is_safe_elem� s z TracHTMLSanitizer.is_safe_elemc C sR d|v r |� dd�d }d|vrdS dd� |� dd�d D �}d�|��� | jv S ) a: Determine whether the given URI is to be considered safe for inclusion in the output. The default implementation checks whether the scheme of the URI is in the set of allowed URIs (`safe_schemes`). >>> sanitizer = TracHTMLSanitizer() >>> sanitizer.is_safe_uri('http://example.org/') True >>> sanitizer.is_safe_uri('javascript:alert(document.cookie)') False :param uri: the URI to check :return: `True` if the URI can be considered safe, `False` otherwise :rtype: `bool` �#r( r �:Tc S s g | ]}|� � r|�qS r$ )�isalnum)rm r r$ r$ r% � <listcomp>� s z1TracHTMLSanitizer.is_safe_uri.<locals>.<listcomp>r& )�splitrv rk r^ )r� �uri�charsr$ r$ r% � is_safe_uri� s z TracHTMLSanitizer.is_safe_uric C s� i }|� � D ]1\}}|du r|}|| jvrq|| jv r"| �|�s!qn|dkr3| �|�}|s.qd�|�}|||< q|dkrMd|v rM| �|d �sMd}d||< |S )a! Remove potentially dangerous attributes and sanitize the style attribute . :param tag: the tag name of the element :type attrs: dict corresponding to tag attributes :return: a dict containing only safe or sanitized attributes :rtype: dict Nra r{ r� r4 � crossorigin� anonymous)r~ r[ r] rx � sanitize_cssrv �_is_safe_origin)r� r r� � new_attrs�attrr= �declsr$ r$ r% �sanitize_attrs� s, � �z TracHTMLSanitizer.sanitize_attrsc s� g }� � � �|��}td|�d��D ]D}|�� }|sqz |�dd�\}}W n ty. Y qw � �|�� �� |�� �s<q� �|�sVt � fdd�� � |�D ��rV|� |�� � q|S )a� Remove potentially dangerous property declarations from CSS code. In particular, properties using the CSS ``url()`` function with a scheme that is not considered safe are removed: >>> sanitizer = TracHTMLSanitizer() >>> sanitizer.sanitize_css(''' ... background: url(javascript:alert("foo")); ... color: #000; ... ''') ['color: #000'] Also, the proprietary Internet Explorer function ``expression()`` is always stripped: >>> sanitizer.sanitize_css(''' ... background: #fff; ... color: #000; ... width: e/**/xpression(alert("F")); ... ''') ['background: #fff', 'color: #000', 'width: e xpression(alert("F"))'] :param text: the CSS text; this is expected to be `str` and to not contain any character or numeric references :return: a list of declarations that are considered safe :rtype: `list` N�;rr r( c 3 s � | ] }� � |�d ��V qdS )r( N)r| r2 )rm r8 r� r$ r% rq � s � �z1TracHTMLSanitizer.sanitize_css.<locals>.<genexpr>) �_strip_css_comments�_replace_unicode_escapesrs ru �strip� ValueErrorrm rk �_EXPRESSION_SEARCH�all� _URL_FINDITERr} )r� r! r �declrl r= r$ r� r% r{ � s* � ���z TracHTMLSanitizer.sanitize_cssz\r\nz8\\([0-9a-fA-F]{1,6})\s?|\\([^\r\n\f0-9a-fA-F'"{};:()#*])c C s | � |�o t| j|�S rl )rx r r_ )r� rv r$ r$ r% r| s �z!TracHTMLSanitizer._is_safe_originc C s dd� }| � || �d|��S )Nc S sZ | � d�}|r t|d�}t|�}|dkrd}|S |dkr d}|S | � d�}|dkr+dS |S )Nr( r+ � rr �\z\\r- )r2 r4 r5 )r8 �tr� r� r$ r$ r% �_repl s � z9TracHTMLSanitizer._replace_unicode_escapes.<locals>._repl� )�_UNICODE_ESCAPE�_NORMALIZE_NEWLINES)r� r! r� r$ r$ r% r� s �z*TracHTMLSanitizer._replace_unicode_escapesz /\*.*?\*/c C s | � d|�S )z�Replace comments with space character instead of superclass which removes comments to avoid problems when nested comments. rr )� _CSS_COMMENTS)r� r! r$ r$ r% r� s z%TracHTMLSanitizer._strip_css_commentsN) r� r� r� r� � frozenset� SAFE_TAGS� SAFE_ATTRS�SAFE_CSS� SAFE_SCHEMES� URI_ATTRS�SAFE_CROSS_ORIGINSr� �re�compile�searchr� �finditerr� rh rm rp rx r� r{ r> r� �UNICODEr� r| r� r� r� r$ r$ r$ r% r � sN �����! /�� r c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) r a� Help base class used for cleaning up HTML riddled with ``<FONT COLOR=...>`` tags and replace them with appropriate ``<span class="...">``. The subclass must define a `rules()` static method returning a list of regular expression fragments, each defining a capture group in which the name will be reused for the span's class. Two special group names, ``font`` and ``endfont`` are used to emit ``<span>`` and ``</span>``, respectively. c C s: t �| �}t| d�st�dd�| �� � �| _| j|_|S )N�_compiled_rulesz(?:%s)�|)�object�__new__�hasattrr� r� rv r0 r� )�clsr� r$ r$ r% r� 0 s zDeuglifier.__new__c C s t �| j| j|�S rl )r� r> r� r )r� �indatar$ r$ r% �format7 � zDeuglifier.formatc C sF |� � �� D ]\}}|r |dkr dS |dkr dS d| S qd S )Nr� z<span>�endfontz</span>z<span class="code-%s">)� groupdictr~ )r� � fullmatch�mtyper8 r$ r$ r% r : s ��zDeuglifier.replaceN)r� r� r� r� r� r� r r$ r$ r$ r% r $ s r c @ �X e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dS )� HTMLTransformz�Convenience base class for writing HTMLParsers. The default implementation of the HTMLParser ``handle_*`` methods do nothing, while in our case we try to rewrite the incoming document unmodified. c C sR t �| � || _t|tj�rdd� | _d S t|tj�r"dd� | _d S dd� | _d S )Nc S � t | t�r | �d�S | S �Nzutf-8)r r� �decode�rx r$ r$ r% rz Q � �z(HTMLTransform.__init__.<locals>.<lambda>c S r� r� )r r �encoder� r$ r$ r% rz T r� c S s | S rl r$ r� r$ r$ r% rz W s )r r� re r ra � TextIOBase�_convert�IOBase)r� re r$ r$ r% r� M s zHTMLTransform.__init__c C � | � | �� � d S rl ��_write�get_starttag_textro r$ r$ r% �handle_starttagY r� z HTMLTransform.handle_starttagc C r� rl r� ro r$ r$ r% �handle_startendtag\ r� z HTMLTransform.handle_startendtagc C � | � d| � d S )Nz <!--%s-->�r� �r� �datar$ r$ r% �handle_comment_ r� z HTMLTransform.handle_commentc C r� �Nz<!%s>r� r� r$ r$ r% � handle_declb r� zHTMLTransform.handle_declc C r� )N�<?%s?>r� r� r$ r$ r% � handle_pie r� zHTMLTransform.handle_pic C s | � |� d S rl r� r� r$ r$ r% � handle_datah s zHTMLTransform.handle_datac C s | � d| d � d S �Nr� r� r� r� r$ r$ r% � handle_endtagk r� zHTMLTransform.handle_endtagc C s | j �| �|�� d S rl )re �writer� r� r$ r$ r% r� n r� zHTMLTransform._writeN) r� r� r� r� r� r� r� r� r� r� r� r� r� r$ r$ r$ r% r� D s r� c @ r� )r z�Identify and protect forms from CSRF attacks. This filter works by adding a input type=hidden field to POST forms. c C s t �| |� || _d S rl )r� r� �token)r� � form_tokenre r$ r$ r% r� y s zFormTokenInjector.__init__c C sZ t �| ||� |�� dkr)|D ]\}}|dkr(|�� dkr(| �d| j � d S qd S d S )Nr� r& �postz5<input type="hidden" name="__FORM_TOKEN" value="%s"/>)r� r� rk r� r� )r� r r� r' r= r$ r$ r% r� } s ���z!FormTokenInjector.handle_starttagN)r� r� r� r� r� r� r$ r$ r$ r% r r s r c @ r� )r` z-Sanitize parsed HTML using TracHTMLSanitizer.c C s t �| |� || _d | _d S rl )r� r� � sanitizer� waiting_for)r� r� re r$ r$ r% r� � s zHTMLSanitization.__init__c sh | j rd S | j�||�s|| _ d S | j�|t|��� d�� fdd�t� �D ��}| �d|||f � d S )Nr& c 3 s$ � | ] }d |t � | �f V qdS )r� Nr� )rm r' �r} r$ r% rq � s � �z1HTMLSanitization._handle_start.<locals>.<genexpr>z<%s%s%s>)r� r� rp r� rb rv ru r� )r� r r� �startend� html_attrsr$ r� r% � _handle_start� s �z HTMLSanitization._handle_startc C � | j s | �||d� d S d S )Nr& �r� r� ro r$ r$ r% r� � � �z HTMLSanitization.handle_starttagc C r� �N�/r� ro r$ r$ r% r� � r� z#HTMLSanitization.handle_startendtagc C s d S rl r$ r� r$ r$ r% r� � r� z HTMLSanitization.handle_commentc C s | j s | �d| � d S d S r� �r� r� r� r$ r$ r% r� � r� z HTMLSanitization.handle_declc C s$ | j s| �d|�dd� � d S d S )Nr� z?>r& )r� r� r r� r$ r$ r% r� � s �zHTMLSanitization.handle_pic C s | j s | �t|�� d S d S rl )r� r� r r� r$ r$ r% r� � r� z HTMLSanitization.handle_datac C s4 | j r| j |kr d | _ d S d S | �d| d � d S r� r� r� r$ r$ r% r� � s �z HTMLSanitization.handle_endtagN) r� r� r� r� r� r� r� r� r� r� r� r� r� r$ r$ r$ r% r` � s r` c C s4 t | t�r | �� } ntt| ��} |s| �dd�} | S )a^ Extract the text elements from (X)HTML content >>> plaintext('<b>1 < 2</b>') '1 < 2' >>> plaintext(tag('1 ', tag.b('<'), ' 2')) '1 < 2' >>> plaintext('''<b>1 ... < ... 2</b>''', keeplinebreaks=False) '1 < 2' :param text: `unicode` or `Fragment` :param keeplinebreaks: optionally keep linebreaks r� rr )r r r� r r r )r! �keeplinebreaksr$ r$ r% r � s r c C s� t | t�r,|dur|| jv r| S |dur!|| j�dd��� v r!| S |dur,|| jkr,| S t | t�rF| jD ]}t||||�}|durE| S q4dS dS )z�Return the first element in the fragment having the given attribute, class or tag, using a preorder depth-first search. Nr` r& ) r r� r� �getru r r r� r )�fragr~ r� r �childr� r$ r$ r% r � s ��r c s� |r d|vr |� d�s dS tdd� | D ��rdS |� d�r&|r&d|j|f }t�d�� � fdd �}||�}| D ]+}||�}||krD dS |�d�rQ|� |�rQ dS |� |�d �rZ|n|d �rb dS q7d S ) z-Whether the given uri is a safe cross-origin.rr z//Tc s s � | ]}|d kV qdS )�*Nr$ )rm �safer$ r$ r% rq � s � z!is_safe_origin.<locals>.<genexpr>z%s:%sz&(?:[a-zA-Z][-a-zA-Z0-9+._]*:)?//[^/]+$c s � � | �r | d7 } | S r� )r8 )rv �� normalize_rer$ r% � normalize_uri� s z%is_safe_origin.<locals>.normalize_urir� F)r3 �any�schemer� r� �endswith)r_ rv �reqr� r� r$ r� r% r � s& �r c C s| t | t�st | t�r't| j�dkr'| jd } t | t�st | t�r't| j�dkstr1t | t�r1| j} t | t�r8| S tt | ��S )z%Convert input to a `Fragment` object.r( r ) r r � Exception�lenrw r r= r r r )r� r$ r$ r% r s � �� r c c s � | ] }|d vr|V qdS ))� r, � Nr$ )rm ry r$ r$ r% rq s � ��rq � c C s | � dt�S )z�Return only valid bytes in XML/HTML from the given data. >>> valid_html_bytes(b'blah') b'blah' >>> list(valid_html_bytes(bytes(range(33)) + b'')) [9, 10, 13, 32, 127] N)r] �_invalid_control_chars)r� r$ r$ r% r s r )T)Fr$ )NNNrl ):ra r� �sysr r � html.parserr � markupsafer r r r r � ImportError� babel.supportr � trac.corer �trac.util.textr �__all__�name2codepoint�copyr6 r r� r= r r �NO_YES�OFF_ON� FALSE_TRUErb rf rk rc re r� r r� r� r� �xmlr� r r r r� r r` r r r r r� �ranger� r r$ r$ r$ r% �<module> s� � � ; 0�������������������������� % '+A B . 3
Save
Cancel