From 6847147e999c2e167fc2c63978b9f118db5b387d Mon Sep 17 00:00:00 2001
From: Shaily <shaily15297@yahoo.com>
Date: Nov 04 2017 23:17:10 +0000
Subject: [PATCH 1/4] Sanitize markdown in Sticky widget


---

diff --git a/hubs/widgets/sticky/__init__.py b/hubs/widgets/sticky/__init__.py
index 7399bff..4cfba8e 100644
--- a/hubs/widgets/sticky/__init__.py
+++ b/hubs/widgets/sticky/__init__.py
@@ -1,6 +1,6 @@
 from __future__ import unicode_literals
 
-from hubs.widgets import validators
+from hubs.widgets import clean_input, validators
 from hubs.widgets.base import Widget
 from hubs.widgets.caching import CachedFunction
 from hubs.widgets.view import RootWidgetView
@@ -40,8 +40,11 @@ class ParseMarkdown(CachedFunction):
 
     def execute(self):
         text = self.instance.config["text"]
-        return markdown(text, extensions=['markdown.extensions.extra',
-                                          'markdown.extensions.sane_lists'])
+        markdown_text = markdown(text,
+                                 extensions=['markdown.extensions.extra',
+                                             'markdown.extensions.sane_lists'])
+        markdown_text = clean_input.clean(markdown_text)
+        return markdown_text
 
     def should_invalidate(self, message):
         return False

From b469f91018eeb75e32642e8da82dbfd3ce76df65 Mon Sep 17 00:00:00 2001
From: Shaily <shaily15297@yahoo.com>
Date: Nov 04 2017 23:17:10 +0000
Subject: [PATCH 2/4] Add method to update test widget configuration


---

diff --git a/hubs/tests/widgets/__init__.py b/hubs/tests/widgets/__init__.py
index 73de0fc..382cb13 100644
--- a/hubs/tests/widgets/__init__.py
+++ b/hubs/tests/widgets/__init__.py
@@ -35,6 +35,11 @@ class WidgetTest(APPTest):
         self.session.commit()
         self.session.refresh(self.widget)
 
+    def _update_widget_config(self, config):
+        self.widget._config = json.dumps(config)
+        self.session.commit()
+        self.session.refresh(self.widget)
+
     def _test_view_authz(self):
         # Test authorizations on the root view.
         if not self.plugin:

From e26d212ba008894e528a7fd8b5853f8668924954 Mon Sep 17 00:00:00 2001
From: Shaily <shaily15297@yahoo.com>
Date: Nov 04 2017 23:17:10 +0000
Subject: [PATCH 3/4] Add test for sanitized markdown output


---

diff --git a/hubs/tests/widgets/test_sticky.py b/hubs/tests/widgets/test_sticky.py
index d4b9902..de2c28c 100644
--- a/hubs/tests/widgets/test_sticky.py
+++ b/hubs/tests/widgets/test_sticky.py
@@ -6,20 +6,28 @@ from . import WidgetTest
 class StickyTest(WidgetTest):
 
     plugin = "sticky"
-    initial_widget_config = {
-        "text": """| Tables        | Are           | Cool  |
-                   | ------------- |:-------------:| -----:|
-                   | col 3 is      | right-aligned | $1600 |
-                   | col 2 is      | centered      |   $12 |
-                   | zebra stripes | are neat      |    $1 |
-                """
-    }
 
     def populate(self):
         super(StickyTest, self).populate()
         self._add_widget_under_test()
 
     def test_markdown_parse(self):
+        self._update_widget_config({
+            "text": """| Tables        | Are           | Cool  |
+                       | ------------- |:-------------:| -----:|
+                       | col 3 is      | right-aligned | $1600 |
+                       | col 2 is      | centered      |   $12 |
+                       | zebra stripes | are neat      |    $1 |
+                    """
+        })
         func = self.widget.module.get_cached_functions()['ParseMarkdown']
         result = func(self.widget).execute()
         self.assertRegexpMatches(result, r'^<table>(?s).*</table>$')
+
+    def test_sanitized_output(self):
+        self._update_widget_config({
+            "text": """<a onClick="alert('hi!');" href="#">some text</a>"""
+        })
+        func = self.widget.module.get_cached_functions()['ParseMarkdown']
+        result = func(self.widget).execute()
+        self.assertNotIn("alert", result)

From a2b0b96fe1debe99b4437b24cc3f1c741b951f2b Mon Sep 17 00:00:00 2001
From: Shaily <shaily15297@yahoo.com>
Date: Nov 04 2017 23:17:10 +0000
Subject: [PATCH 4/4] Update allowed tags


---

diff --git a/hubs/widgets/clean_input.py b/hubs/widgets/clean_input.py
index 9d25104..8438199 100644
--- a/hubs/widgets/clean_input.py
+++ b/hubs/widgets/clean_input.py
@@ -27,15 +27,20 @@ def clean(text, ignore=None):
         ignore = [ignore]
 
     attrs = bleach.ALLOWED_ATTRIBUTES
+
     if not ignore or 'img' not in ignore:
         attrs['img'] = filter_img_src
 
     tags = bleach.ALLOWED_TAGS + [
-        'p', 'br', 'div', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
-        'table', 'td', 'tr', 'th',
-        'col', 'tbody', 'pre', 'img', 'hr', 'dl', 'dt', 'dd', 'span',
-        'kbd', 'var',
+        'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+        'em', 'strong', 'del',
+        'ol', 'ul', 'li', 'dl', 'dt', 'dd'
+        'a', 'img', 'pre', 'code',
+        'table', 'thead', 'tbody', 'th', 'tr', 'td',
+        'blockquote', 'hr',
+        'p', 'div', 'span', 'br'
     ]
+
     if ignore:
         for tag in ignore:
             if tag in tags: