12725N/APatch taken from https://review.openstack.org/329997 (Liberty) and

12725N/Aslightly modified to adjust for gpatch fuzz for application to Kilo.

12725N/A

12725N/AFrom d585e5eb9acf92d10d39b6c2038917a7e8ac71bb Mon Sep 17 00:00:00 2001

12725N/AFrom: Richard Jones <r1chardj0n3s@gmail.com>

12725N/ADate: Tue, 3 May 2016 15:51:49 +1000

12725N/ASubject: [PATCH] Escape angularjs templating in unsafe HTML

18785N/A

12725N/AThis code extends the unsafe (typically user-supplied) HTML escape

12725N/Abuilt into Django to also escape angularjs templating markers. Safe

12725N/AHTML will be unaffected.

12725N/A

12725N/ACloses-bug: 1567673

Change-Id: I0cbebfd0f814bdf1bf8c06833abf33cc2d4748e7

(cherry picked from commit 4bc01cedf39cdeff2553d01cdace707a1ecf6620)

---

horizon/utils/escape.py | 31 +++++++++++++++++++++++++++++++

openstack_dashboard/settings.py | 3 +++

openstack_dashboard/test/settings.py | 6 ++++++

3 files changed, 40 insertions(+)

create mode 100644 horizon/utils/escape.py

diff --git a/horizon/utils/escape.py b/horizon/utils/escape.py

new file mode 100644

index 0000000..471a90f

--- /dev/null

+++ b/horizon/utils/escape.py

@@ -0,0 +1,31 @@

+# Copyright 2016, Rackspace, US, Inc.

+#

+# Licensed under the Apache License, Version 2.0 (the "License");

+# you may not use this file except in compliance with the License.

+# You may obtain a copy of the License at

+#

+# http://www.apache.org/licenses/LICENSE-2.0

+#

+# Unless required by applicable law or agreed to in writing, software

+# distributed under the License is distributed on an "AS IS" BASIS,

+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

+# See the License for the specific language governing permissions and

+# limitations under the License.

+

+import django.utils.html

+

+

+def escape(text, existing=django.utils.html.escape):

+ # Replace our angular markup string with a different string

+ # (which just happens to be the Django comment string)

+ # this prevents user-supplied data from being intepreted in

+ # our pages by angularjs, thus preventing it from being used

+ # for XSS attacks. Note that we use {$ $} instead of the

+ # standard {{ }} - this is configured in horizon.framework

+ # angularjs module through $interpolateProvider

+ return existing(text).replace('{$', '{%').replace('$}', '%}')

+

+

+# this will be invoked as early as possible in settings.py

+def monkeypatch_escape():

+ django.utils.html.escape = escape

diff --git a/openstack_dashboard/settings.py b/openstack_dashboard/settings.py

index 5761a91..803b079 100644

--- a/openstack_dashboard/settings.py

+++ b/openstack_dashboard/settings.py

@@ -27,6 +27,9 @@ from openstack_dashboard import exceptions

from openstack_dashboard import exceptions

from openstack_dashboard.static_settings import get_staticfiles_dirs # noqa

+from horizon.utils.escape import monkeypatch_escape

+

+monkeypatch_escape()

warnings.formatwarning = lambda message, category, *args, **kwargs: \

'%s: %s' % (category.__name__, message)

diff --git a/openstack_dashboard/test/settings.py b/openstack_dashboard/test/settings.py

index 1926644..45f1d06 100644

--- a/openstack_dashboard/test/settings.py

+++ b/openstack_dashboard/test/settings.py

@@ -17,6 +17,12 @@ from openstack_dashboard import exceptions

from openstack_dashboard import exceptions

from openstack_dashboard.static_settings import get_staticfiles_dirs # noqa

+from horizon.utils.escape import monkeypatch_escape

+

+# this is used to protect from client XSS attacks, but it's worth

+# enabling in our test setup to find any issues it might cause

+monkeypatch_escape()

+

STATICFILES_DIRS = get_staticfiles_dirs()

TEST_DIR = os.path.dirname(os.path.abspath(__file__))

--

1.9.1