From 842486304506bf6ee05f8e01a4d0a56b71788b39 Mon Sep 17 00:00:00 2001 From: Aurélien Bompard Date: Mar 13 2026 08:47:36 +0000 Subject: Disable the include directive when showing RST files Signed-off-by: Aurélien Bompard --- diff --git a/pagure/doc_utils.py b/pagure/doc_utils.py index 3fb9d81..8c5881c 100644 --- a/pagure/doc_utils.py +++ b/pagure/doc_utils.py @@ -83,7 +83,7 @@ def convert_doc(rst_string, view_file_url=None): """Utility to load an RST file and turn it into fancy HTML.""" rst = modify_rst(rst_string, view_file_url) - overrides = {"report_level": "quiet"} + overrides = {"report_level": "quiet", "file_insertion_enabled": False} try: html = docutils.core.publish_parts( source=rst, writer_name="html", settings_overrides=overrides diff --git a/tests/test_pagure_flask_ui_repo.py b/tests/test_pagure_flask_ui_repo.py index a01c6b5..9850a85 100644 --- a/tests/test_pagure_flask_ui_repo.py +++ b/tests/test_pagure_flask_ui_repo.py @@ -3111,6 +3111,25 @@ class PagureFlaskRepotests(tests.Modeltests): output_text = output.get_data(as_text=True) self.assertEqual("foo\n bar", output_text) + def test_view_rst_no_include(self): + """Test that the include directive is disabled in RST files.""" + tests.create_projects(self.session) + tests.create_projects_git(os.path.join(self.path, "repos"), bare=True) + tests.add_content_to_git( + os.path.join(self.path, "repos", "test.git"), + filename="with-include.rst", + content=".. include:: /etc/passwd", + ) + output = self.app.get("/test/blob/master/f/with-include.rst") + self.assertEqual(output.status_code, 200) + output_text = output.get_data(as_text=True) + # The output must not contain the content of the file pointed to by the + # include directive + self.assertNotIn( + 'root:x:0:0', + output_text, + ) + def test_view_raw_file(self): """Test the view_raw_file endpoint.""" output = self.app.get("/foo/raw/foo/sources")