Git-Mirrors/onionshare
1
0
Fork 0
mirror of https://github.com/onionshare/onionshare.git synced 2024-10-01 01:35:40 -04:00
Code Issues Packages Projects Releases Wiki Activity

Replaced sanitize_html() function that was based on regex with python3's html.escape()

Browse Source
This commit is contained in:
Micah Lee 2016-12-21 22:56:15 -08:00
parent 737d1697b7
commit cff11cd7e4
No known key found for this signature in database
GPG Key ID: 403C2657CD994F73
1 changed files with 2 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
onionshare/web.py
View File

@ -17,7 +17,7 @@ GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
"""
import queue, mimetypes, platform, os, sys, socket, logging, re
import queue, mimetypes, platform, os, sys, socket, logging, html
from urllib.request import urlopen
from flask import Flask, Response, request, render_template_string, abort
@ -30,18 +30,6 @@ file_info = []
zip_filename = None
zip_filesize = None
def sanitize_html(basename):
"""
Takes a string, called basename, and removes any HTML that could be in the
string. If the resulting string is empty, return the string 'file', which
is not ideal, but better than embedded HTML that could run JS.
"""
html_regex = re.compile('<.*?>')
sanitized_name = re.sub(html_regex , '', basename)
if sanitized_name == '':
sanitized_name = 'file'
return sanitized_name
def set_file_info(filenames):
"""
Using the list of filenames being shared, fill in details that the web
@ -54,7 +42,7 @@ def set_file_info(filenames):
file_info = {'files': [], 'dirs': []}
for filename in filenames:
# strips trailing '/' and sanitizes filename
basename = sanitize_html(os.path.basename(filename.rstrip('/')))
basename = html.escape(os.path.basename(filename.rstrip('/')))
info = {
'filename': filename,
'basename': basename