#25872: Title attribute for related widget links lacks escaping (and breaks
html)
---------------------------------+------------------------------------
Reporter: a1tus | Owner: nobody
Type: Bug | Status: new
Component: contrib.admin | Version: 1.8
Severity: Release blocker | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------
Comment (by a1tus):
I'm back with my super ''grep'' investigation!
I've checked Django 1.9 templates.
In contrib.admin we have 20 usages of `blocktrans` tag and 88 usages of a
simple `trans` tag.
Possibly unsafe usages of `blocktrans`:
{{{
# admin\change_list_results.html (1 hit)
Line 18: {% if num_sorted_fields > 1 %}<span class="sortpriority"
title="{% blocktrans with priority_number=header.sort_priority %}Sorting
priority: {{ priority_number }}{% endblocktrans %}">{{
header.sort_priority }}</span>{% endif %}
# admin\index.html (1 hit)
Line 20: <a href="{{ app.app_url }}" class="section" title="{% blocktrans
with name=app.name %}Models in the {{ name }} application{% endblocktrans
%}">{{ app.name }}</a>
# admin\related_widget_wrapper.html (3 hits)
Line 8: title="{% blocktrans %}Change selected {{ model }}{% endblocktrans
%}">
Line 15: title="{% blocktrans %}Add another {{ model }}{% endblocktrans
%}">
Line 22: title="{% blocktrans %}Delete selected {{ model }}{%
endblocktrans %}">
}}}
... and `trans`:
{{{
C:\Users\alTus\Desktop\Django-1.9\django\contrib\admin\templates\admin\actions.html
(4 hits)
Line 4: <button type="submit" class="button" title="{% trans "Run the
selected action" %}" name="index" value="{{ action_index|default:0 }}">{%
trans "Go" %}</button>
Line 4: <button type="submit" class="button" title="{% trans "Run the
selected action" %}" name="index" value="{{ action_index|default:0 }}">{%
trans "Go" %}</button>
Line 11: <a href="javascript:;" title="{% trans "Click here to select the
objects across all pages" %}">{% blocktrans with cl.result_count as
total_count %}Select all {{ total_count }} {{ module_name }}{%
endblocktrans %}</a>
Line 54: <input type="submit" value="{% trans 'Change password' %}"
class="default" />
C:\Users\alTus\Desktop\Django-1.9\django\contrib\admin\templates\admin\change_list_results.html
(2 hits)
Line 17: <a class="sortremove" href="{{ header.url_remove }}" title="{%
trans "Remove from sorting" %}"></a>
Line 19: <a href="{{ header.url_toggle }}" class="toggle {% if
header.ascending %}ascending{% else %}descending{% endif %}" title="{%
trans "Toggle sorting" %}"></a>
C:\Users\alTus\Desktop\Django-1.9\django\contrib\admin\templates\admin\delete_confirmation.html
(5 hits)
Line 41: <input type="submit" value="{% trans "Yes, I'm sure" %}" />
C:\Users\alTus\Desktop\Django-1.9\django\contrib\admin\templates\admin\delete_selected_confirmation.html
(5 hits)
Line 44: <input type="submit" value="{% trans "Yes, I'm sure" %}" />
C:\Users\alTus\Desktop\Django-1.9\django\contrib\admin\templates\admin\login.html
(4 hits)
Line 61: <label> </label><input type="submit" value="{% trans 'Log
in' %}" />
C:\Users\alTus\Desktop\Django-1.9\django\contrib\admin\templates\admin\pagination.html
(2 hits)
Line 11: {% if cl.formset and cl.result_count %}<input type="submit"
name="_save" class="default" value="{% trans 'Save' %}"/>{% endif %}
C:\Users\alTus\Desktop\Django-1.9\django\contrib\admin\templates\admin\related_widget_wrapper.html
(3 hits)
Line 9: <img src="{% static 'admin/img/icon-changelink.svg' %}" alt="{%
trans 'Change' %}"/>
Line 16: <img src="{% static 'admin/img/icon-addlink.svg' %}" alt="{%
trans 'Add' %}"/>
Line 23: <img src="{% static 'admin/img/icon-deletelink.svg' %}" alt="{%
trans 'Delete' %}"/>
C:\Users\alTus\Desktop\Django-1.9\django\contrib\admin\templates\admin\search_form.html
(2 hits)
Line 7: <input type="submit" value="{% trans 'Search' %}" />
C:\Users\alTus\Desktop\Django-1.9\django\contrib\admin\templates\admin\submit_line.html
(5 hits)
Line 3: {% if show_save %}<input type="submit" value="{% trans 'Save' %}"
class="default" name="_save" />{% endif %}
Line 8: {% if show_save_as_new %}<input type="submit" value="{% trans
'Save as new' %}" name="_saveasnew" />{% endif %}
Line 9: {% if show_save_and_add_another %}<input type="submit" value="{%
trans 'Save and add another' %}" name="_addanother" />{% endif %}
Line 10: {% if show_save_and_continue %}<input type="submit" value="{%
trans 'Save and continue editing' %}" name="_continue" />{% endif %}
}}}
Some of the usages (like "save") seem to be quite safe but anyway I think
that some solid approach in escaping translated string is needed.
Also as I've seen the method of force escaping blocktrans contents is
already used in admin for js code.
For example `{% filter escapejs %}` in tabulars:
{{{
<script type="text/javascript">
(function($) {
$("#{{ inline_admin_formset.formset.prefix|escapejs }}-group .inline-
related").stackedFormset({
prefix: "{{ inline_admin_formset.formset.prefix|escapejs }}",
deleteText: "{% filter escapejs %}{% trans "Remove" %}{% endfilter
%}",
addText: "{% filter escapejs %}{% blocktrans with
verbose_name=inline_admin_formset.opts.verbose_name|capfirst %}Add another
{{ verbose_name }}{% endblocktrans %}{% endfilter %}"
});
})(django.jQuery);
</script>
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/25872#comment:10>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/063.5707b071f28f6025a4e078bfe5becb41%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
