Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address an issue where <script> tags aren't stripped. #892

Merged
merged 7 commits into from
Jan 24, 2018
+34 −1,444
Merged

Address an issue where <script> tags aren't stripped. #892

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e2f7d2e
Address an issue where <script> tags weren't stripped.
Jan 23, 2018
c5f5168
Address a Travis issue by storing the result of empty() in a variable.
Jan 23, 2018
335d9ce
Test that <script> is removed, as it is missing an attribute.
Jan 23, 2018
f6ef76e
Add failing test case for sanitizing script[async] element
westonruter Jan 23, 2018
86bdf13
Skip pulling latest from amphtml repo if not on master branch
westonruter Jan 23, 2018
17f63ac
Remove unused validator_gen_md import and patch to keep it around
westonruter Jan 24, 2018
d25e48f
Temporarily skip extension SCRIPT tags in HEAD
westonruter Jan 24, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
221 changes: 0 additions & 221 deletions bin/amphtml-fix.diff
View file
Open in desktop

This file was deleted.

21 changes: 15 additions & 6 deletions bin/amphtml-update.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
Follow the steps below to generate a new version of the allowed tags class:

- Download a copy of the latet AMPHTML repository from github:

git clone [email protected]:ampproject/amphtml.git

- Copy this file into the repo's validator subdirectory:
Expand Down Expand Up @@ -99,7 +99,7 @@ def GenValidatorProtoascii(out_dir):


def GeneratePHP(out_dir):
"""Calls validator_gen_md to generate validator-generated.md.
"""Generates PHP for WordPress AMP plugin to consume.

Args:
out_dir: directory name of the output directory. Must not have slashes,
Expand Down Expand Up @@ -223,15 +223,15 @@ def GenerateAttributesPHP(out, attributes, indent_level = 4):
indent = ''
for i in range(0,indent_level):
indent += '\t'

sorted_attributes = sorted(attributes.items())
for (attribute, values) in collections.OrderedDict(sorted_attributes).iteritems():
logging.info('generating php for attribute: %s...' % attribute.lower())
out.append('%s\'%s\' => array(' % (indent, attribute.lower()))
GeneratePropertiesPHP(out, values)
out.append('%s),' % indent)
logging.info('...done with: %s' % attribute.lower())

out.append('')
logging.info('... done')

Expand Down Expand Up @@ -336,7 +336,6 @@ def ParseRules(out_dir):
# are checked by CheckPrereqs.
from google.protobuf import text_format
from amp_wp import validator_pb2
import validator_gen_md

allowed_tags = {}
attr_lists = {}
Expand Down Expand Up @@ -399,7 +398,14 @@ def ParseRules(out_dir):
else:
tag_list = allowed_tags[UnicodeEscape(tag_spec.tag_name)]
# AddTag(allowed_tags, tag_spec, attr_lists)
tag_list.append(GetTagSpec(tag_spec, attr_lists))

gotten_tag_spec = GetTagSpec(tag_spec, attr_lists)

# Temporarily skip extension SCRIPT elemeents which appear in the HEAD.
if 'SCRIPT' == tag_spec.tag_name and gotten_tag_spec['tag_spec'].get( '_is_extension_spec', False ):
continue

tag_list.append(gotten_tag_spec)
allowed_tags[UnicodeEscape(tag_spec.tag_name)] = tag_list

logging.info('... done')
Expand Down Expand Up @@ -449,6 +455,9 @@ def GetTagRules(tag_spec):
html_format_list.append('amp4ads')
tag_rules['html_format'] = {'html_format': html_format_list}

if tag_spec.HasField('extension_spec'):
tag_rules['_is_extension_spec'] = True;

if tag_spec.HasField('mandatory'):
tag_rules['mandatory'] = tag_spec.mandatory

Expand Down
9 changes: 3 additions & 6 deletions bin/amphtml-update.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,18 +27,15 @@ if [[ ! -e $VENDOR_PATH/amphtml ]]; then
git clone https://github.com/ampproject/amphtml amphtml
else
cd $VENDOR_PATH/amphtml/validator
git pull
if [ 'master' == $( git rev-parse --abbrev-ref HEAD ) ]; then
git pull origin master
fi
fi

# Copy script to location and go there.
cp $BIN_PATH/amphtml-update.py $VENDOR_PATH/amphtml/validator
cd $VENDOR_PATH/amphtml/validator

# Temporary fix until https://github.com/ampproject/amphtml/issues/12371 is addressed.
if [ ! -f $VENDOR_PATH/amphtml/validator/validator_gen_md.py ]; then
git apply $BIN_PATH/amphtml-fix.diff
fi

# Run script.
python amphtml-update.py
cp amp_wp/class-amp-allowed-tags-generated.php ../../../includes/sanitizers/
Loading