From f7ca8c15dd79d7d09f637c0999b305f51feb5e54 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 04 2019 15:28:39 +0000
Subject: [PATCH 1/2] Make the CSP header be bytes not unicode


Header names must be byte string not unicode string, so we need
to make sure our CSP header complies with that.

Otherwise we run into:
  Apache returning a 500 error:
    TypeError: expected byte string object for header name,
    value of type unicode found

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/flask_app.py b/pagure/flask_app.py
index 79a912c..6f16786 100644
--- a/pagure/flask_app.py
+++ b/pagure/flask_app.py
@@ -502,7 +502,7 @@ def after_request(response):
         csp_headers = csp_headers.format(nonce=flask.g.nonce)
     except (KeyError, IndexError):
         pass
-    response.headers.set("Content-Security-Policy", csp_headers)
+    response.headers.set(str("Content-Security-Policy"), csp_headers)
     return response
 
 

From 13df53316c64b87ba4bb8223b6db9ee2e0f7e4eb Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 04 2019 19:04:58 +0000
Subject: [PATCH 2/2] Allow class on td and id and data-line-number on a


This basically allows for elements added by the blame_loc
filter to appear in the html since this html is passed through
the bleach filter which limits the number of attributes an
element can have.

Incidentally, this commit also fixes the test suite

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/lib/query.py b/pagure/lib/query.py
index 1601de1..008e731 100644
--- a/pagure/lib/query.py
+++ b/pagure/lib/query.py
@@ -4368,8 +4368,9 @@ def clean_input(text, ignore=None):
     attrs["table"] = ["class"]
     attrs["span"] = ["class", "id"]
     attrs["div"] = ["class", "id"]
-    attrs["td"] = ["align"]
+    attrs["td"] = ["align", "class"]
     attrs["th"] = ["align"]
+    attrs["a"].extend(["id", "data-line-number"])
     if not ignore or "img" not in ignore:
         # newer bleach need three args for attribute callable
         if tuple(bleach_v) >= (2, 0, 0):  # pragma: no cover
diff --git a/tests/test_pagure_flask_ui_repo.py b/tests/test_pagure_flask_ui_repo.py
index 31dcda6..4e2cbe3 100644
--- a/tests/test_pagure_flask_ui_repo.py
+++ b/tests/test_pagure_flask_ui_repo.py
@@ -2877,10 +2877,12 @@ class PagureFlaskRepotests(tests.Modeltests):
         self.assertEqual(output.status_code, 200)
         output_text = output.get_data(as_text=True)
         self.assertIn('<table class="code_table">', output_text)
-        self.assertIn(
+        self.assertTrue(
             '<tr><td class="cell1"><a id="1" href="#1" '
-            'data-line-number="1"></a></td>',
-            output_text,
+            'data-line-number="1"></a></td>' in output_text
+            or
+            '<tr><td class="cell1"><a data-line-number="1" '
+            'href="#1" id="1"></a></td>' in output_text
         )
         self.assertIn(
             '<td class="cell2"><pre><code> bar</code></pre></td>', output_text
@@ -2899,10 +2901,12 @@ class PagureFlaskRepotests(tests.Modeltests):
         self.assertEqual(output.status_code, 200)
         output_text = output.get_data(as_text=True)
         self.assertIn('<table class="code_table">', output_text)
-        self.assertIn(
+        self.assertTrue(
             '<tr><td class="cell1"><a id="1" href="#1" '
-            'data-line-number="1"></a></td>',
-            output_text,
+            'data-line-number="1"></a></td>' in output_text
+            or
+            '<tr><td class="cell1"><a data-line-number="1" '
+            'href="#1" id="1"></a></td>' in output_text
         )
         self.assertIn(
             '<td class="cell2"><pre><code> bar</code></pre></td>', output_text
@@ -2916,10 +2920,12 @@ class PagureFlaskRepotests(tests.Modeltests):
         self.assertEqual(output.status_code, 200)
         output_text = output.get_data(as_text=True)
         self.assertIn('<table class="code_table">', output_text)
-        self.assertIn(
+        self.assertTrue(
             '<tr><td class="cell1"><a id="1" href="#1" '
-            'data-line-number="1"></a></td>',
-            output_text,
+            'data-line-number="1"></a></td>' in output_text
+            or
+            '<tr><td class="cell1"><a data-line-number="1" '
+            'href="#1" id="1"></a></td>' in output_text
         )
         self.assertIn(
             '<td class="cell2"><pre><code> bar</code></pre></td>', output_text
@@ -2966,10 +2972,12 @@ class PagureFlaskRepotests(tests.Modeltests):
         )
         self.assertIn("</span>&nbsp; Šource", output_text)
         self.assertIn('<table class="code_table">', output_text)
-        self.assertIn(
+        self.assertTrue(
             '<tr><td class="cell1"><a id="1" href="#1" '
-            'data-line-number="1"></a></td>',
-            output_text,
+            'data-line-number="1"></a></td>' in output_text
+            or
+            '<tr><td class="cell1"><a data-line-number="1" '
+            'href="#1" id="1"></a></td>' in output_text
         )
         self.assertIn(
             '<td class="cell2"><pre><code>Row 0</code></pre></td>', output_text
@@ -3006,10 +3014,12 @@ class PagureFlaskRepotests(tests.Modeltests):
         self.assertEqual(output.status_code, 200)
         output_text = output.get_data(as_text=True)
         self.assertIn('<table class="code_table">', output_text)
-        self.assertIn(
+        self.assertTrue(
             '<tr><td class="cell1"><a id="1" href="#1" '
-            'data-line-number="1"></a></td>',
-            output_text,
+            'data-line-number="1"></a></td>' in output_text
+            or
+            '<tr><td class="cell1"><a data-line-number="1" '
+            'href="#1" id="1"></a></td>' in output_text
         )
         self.assertIn(
             '<td class="cell2"><pre><code> barRow 0</code></pre></td>',
@@ -3045,10 +3055,12 @@ class PagureFlaskRepotests(tests.Modeltests):
         self.assertEqual(output.status_code, 200)
         output_text = output.get_data(as_text=True)
         self.assertIn('<table class="code_table">', output_text)
-        self.assertIn(
+        self.assertTrue(
             '<tr><td class="cell1"><a id="1" href="#1" '
-            'data-line-number="1"></a></td>',
-            output_text,
+            'data-line-number="1"></a></td>' in output_text
+            or
+            '<tr><td class="cell1"><a data-line-number="1" '
+            'href="#1" id="1"></a></td>' in output_text
         )
         self.assertIn(
             '<td class="cell2"><pre><code> bar</code></pre></td>', output_text