From 7614361cc0a89a15a44850928511186f28c76a89 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: May 31 2015 07:24:35 +0000
Subject: [PATCH 1/6] Mark only rest, markdown and html documentations as safe


---

diff --git a/pagure/doc_utils.py b/pagure/doc_utils.py
index 0506489..6765063 100644
--- a/pagure/doc_utils.py
+++ b/pagure/doc_utils.py
@@ -89,13 +89,17 @@ def convert_readme(content, ext, view_file_url=None):
     provided.
     '''
     output = content
+    safe = False
     if ext and ext in ['.rst']:
+        safe = True
         output = convert_doc(content, view_file_url)
     elif ext and ext in ['.mk']:
         output = markdown.markdown(content)
+        safe = True
     elif not ext or (ext and ext in ['.text', '.txt']):
+        safe = True
         output = '<pre>%s</pre>' % content
-    return output
+    return output, safe
 
 
 def load_doc(endpoint):
diff --git a/pagure/templates/docs.html b/pagure/templates/docs.html
index 29ff911..0ca64cc 100644
--- a/pagure/templates/docs.html
+++ b/pagure/templates/docs.html
@@ -72,9 +72,9 @@
 
   {% if content %}
   <section class="docs_content">
-    {% autoescape false %}
-    {{ content }}
-    {% endautoescape %}
+    {% if safe }}
+    {{ content |safe }}
+    {% endif %}
   </section>
   {% endif %}
 
diff --git a/pagure/ui/docs.py b/pagure/ui/docs.py
index c4f2362..7d6cf59 100644
--- a/pagure/ui/docs.py
+++ b/pagure/ui/docs.py
@@ -64,10 +64,10 @@ def __get_tree_and_content(repo_obj, commit, path):
     if isinstance(blob_or_tree, pygit2.TreeEntry):  # Returned a file
         ext = os.path.splitext(blob_or_tree.name)[1]
         blob_obj = repo_obj[blob_or_tree.oid]
-        content = pagure.doc_utils.convert_readme(blob_obj.data, ext)
+        content, safe = pagure.doc_utils.convert_readme(blob_obj.data, ext)
 
     tree = sorted(tree_obj, key=lambda x: x.filemode)
-    return (tree, content, extended)
+    return (tree, content, safe, extended)
 
 
 # URLs
@@ -124,7 +124,7 @@ def view_docs(repo, username=None, branchname=None, filename=None):
 
     if commit:
         try:
-            (tree, content, extended) = __get_tree_and_content(
+            (tree, content, safe, extended) = __get_tree_and_content(
                 repo_obj, commit, path)
             if extended:
                 filename += '/'
@@ -141,4 +141,5 @@ def view_docs(repo, username=None, branchname=None, filename=None):
         filename=filename,
         tree=tree,
         content=content,
+        safe=safe,
     )

From a7a30af4f42740ef107be7c53baffa2226bacf4f Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: May 31 2015 09:09:07 +0000
Subject: [PATCH 2/6] By default, we are not safe


---

diff --git a/pagure/ui/docs.py b/pagure/ui/docs.py
index 7d6cf59..6d5503d 100644
--- a/pagure/ui/docs.py
+++ b/pagure/ui/docs.py
@@ -117,6 +117,7 @@ def view_docs(repo, username=None, branchname=None, filename=None):
 
     content = None
     tree = None
+    safe = False
     if not filename:
         path = ['']
     else:

From 61c98ffe82491f180910f22371c97b993bf88ba9 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: May 31 2015 09:14:00 +0000
Subject: [PATCH 3/6] Fix typo and still display un-safe content, but do not render it


---

diff --git a/pagure/templates/docs.html b/pagure/templates/docs.html
index 0ca64cc..8fd4b57 100644
--- a/pagure/templates/docs.html
+++ b/pagure/templates/docs.html
@@ -72,8 +72,10 @@
 
   {% if content %}
   <section class="docs_content">
-    {% if safe }}
+    {% if safe %}
     {{ content |safe }}
+    {% else %}
+    {{ content }}
     {% endif %}
   </section>
   {% endif %}

From c390584d530e667a42f971388dc744269644725b Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: May 31 2015 17:39:55 +0000
Subject: [PATCH 4/6] Always return 4 objects


---

diff --git a/pagure/ui/docs.py b/pagure/ui/docs.py
index 6d5503d..58e361d 100644
--- a/pagure/ui/docs.py
+++ b/pagure/ui/docs.py
@@ -55,7 +55,7 @@ def __get_tree_and_content(repo_obj, commit, path):
         repo_obj, commit.tree, path)
 
     if blob_or_tree is None:
-        return (tree_obj, None, extended)
+        return (tree_obj, None, False, extended)
 
     if not repo_obj[blob_or_tree.oid]:
         # Not tested and no idea how to test it, but better safe than sorry

From bc85d8d2786f3d5c315de5214a74fd2726e3138c Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 01 2015 07:03:18 +0000
Subject: [PATCH 5/6] Create a noJS jinja filter aiming at disabling JS code in the doc pages


---

diff --git a/pagure/ui/filters.py b/pagure/ui/filters.py
index 0528f24..276cc06 100644
--- a/pagure/ui/filters.py
+++ b/pagure/ui/filters.py
@@ -290,3 +290,13 @@ def insert_div(content):
     output = output.replace('h1', 'h3')
 
     return output
+
+
+@APP.template_filter('noJS')
+def no_js(content):
+    """ Template filter replacing <script by &lt;script and </script> by
+    &lt;/script&gt;
+    """
+    content = content.replace('<script', '&lt;script')
+    content = content.replace('</script>', '&lt;/script&gt;')
+    return content

From 88218eafb66d63ae7edd2f8a726bfbd3300719a5 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 01 2015 07:04:19 +0000
Subject: [PATCH 6/6] Always try to disable JavaScript in the doc pages


---

diff --git a/pagure/templates/docs.html b/pagure/templates/docs.html
index 8fd4b57..46bd41c 100644
--- a/pagure/templates/docs.html
+++ b/pagure/templates/docs.html
@@ -73,9 +73,9 @@
   {% if content %}
   <section class="docs_content">
     {% if safe %}
-    {{ content |safe }}
+    {{ content |noJS |safe }}
     {% else %}
-    {{ content }}
+    {{ content |noJS }}
     {% endif %}
   </section>
   {% endif %}