A super strict HTML cleaner method with mediocre tests.

[mediagoblin.git] / mediagoblin / util.py

diff --git a/mediagoblin/util.py b/mediagoblin/util.py
index a0a09adf5c601a7cce307c5deaae8da9e4aa5e94..fc380f4120f617473efe0e9e90994bdcd2fb662b 100644 (file)
--- a/mediagoblin/util.py
+++ b/mediagoblin/util.py
@@ -30,8 +30,9 @@ import jinja2
 import translitcodec
 from paste.deploy.loadwsgi import NicerConfigParser
 from webob import Response, exc
+from lxml.html.clean import Cleaner
 
-from mediagoblin import globals as mgoblin_globals
+from mediagoblin import mg_globals
 from mediagoblin.db.util import ObjectId
 
 
@@ -44,6 +45,26 @@ def _activate_testing():
     TESTS_ENABLED = True
 
 
+def clear_test_buckets():
+    """
+    We store some things for testing purposes that should be cleared
+    when we want a "clean slate" of information for our next round of
+    tests.  Call this function to wipe all that stuff clean.
+
+    Also wipes out some other things we might redefine during testing,
+    like the jinja envs.
+    """
+    global SETUP_JINJA_ENVS
+    SETUP_JINJA_ENVS = {}
+
+    global EMAIL_TEST_INBOX
+    global EMAIL_TEST_MBOX_INBOX
+    EMAIL_TEST_INBOX = []
+    EMAIL_TEST_MBOX_INBOX = []
+
+    clear_test_template_context()
+
+
 def get_jinja_loader(user_template_path=None):
     """
     Set up the Jinja template loaders, possibly allowing for user
@@ -82,8 +103,8 @@ def get_jinja_env(template_loader, locale):
         extensions=['jinja2.ext.i18n'])
 
     template_env.install_gettext_callables(
-        mgoblin_globals.translations.gettext,
-        mgoblin_globals.translations.ngettext)
+        mg_globals.translations.gettext,
+        mg_globals.translations.ngettext)
 
     if exists(locale):
         SETUP_JINJA_ENVS[locale] = template_env
@@ -95,7 +116,7 @@ def get_jinja_env(template_loader, locale):
 TEMPLATE_TEST_CONTEXT = {}
 
 
-def render_template(request, template, context):
+def render_template(request, template_path, context):
     """
     Render a template with context.
 
@@ -103,12 +124,12 @@ def render_template(request, template, context):
     Also stores the context if we're doing unit tests.  Helpful!
     """
     template = request.template_env.get_template(
-        template)
+        template_path)
     context['request'] = request
     rendered = template.render(context)
 
     if TESTS_ENABLED:
-        TEMPLATE_TEST_CONTEXT[template] = context
+        TEMPLATE_TEST_CONTEXT[template_path] = context
 
     return rendered
 
@@ -244,9 +265,9 @@ def send_email(from_addr, to_addrs, subject, message_body):
      - message_body: email body text
     """
     # TODO: make a mock mhost if testing is enabled
-    if TESTS_ENABLED or mgoblin_globals.email_debug_mode:
+    if TESTS_ENABLED or mg_globals.email_debug_mode:
         mhost = FakeMhost()
-    elif not mgoblin_globals.email_debug_mode:
+    elif not mg_globals.email_debug_mode:
         mhost = smtplib.SMTP()
 
     mhost.connect()
@@ -259,7 +280,7 @@ def send_email(from_addr, to_addrs, subject, message_body):
     if TESTS_ENABLED:
         EMAIL_TEST_INBOX.append(message)
 
-    if getattr(mgoblin_globals, 'email_debug_mode', False):
+    if getattr(mg_globals, 'email_debug_mode', False):
         print u"===== Email ====="
         print u"From address: %s" % message['From']
         print u"To addresses: %s" % message['To']
@@ -353,6 +374,32 @@ def read_config_file(conf_file):
     return mgoblin_conf
 
 
+# A super strict version of the lxml.html cleaner class
+HTML_CLEANER = Cleaner(
+    scripts=True,
+    javascript=True,
+    comments=True,
+    style=True,
+    links=True,
+    page_structure=True,
+    processing_instructions=True,
+    embedded=True,
+    frames=True,
+    forms=True,
+    annoying_tags=True,
+    allow_tags=[
+        'div', 'b', 'i', 'em', 'strong', 'p', 'ul', 'ol', 'li', 'a', 'br'],
+    remove_unknown_tags=False, # can't be used with allow_tags
+    safe_attrs_only=True,
+    add_nofollow=True, # for now
+    host_whitelist=(),
+    whitelist_tags=set([]))
+
+
+def clean_html(html):
+    return HTML_CLEANER.clean_html(html)
+
+
 SETUP_GETTEXTS = {}
 
 def setup_gettext(locale):
@@ -373,7 +420,7 @@ def setup_gettext(locale):
         if exists(locale):
             SETUP_GETTEXTS[locale] = this_gettext
 
-    mgoblin_globals.setup_globals(
+    mg_globals.setup_globals(
         translations=this_gettext)