196 lines
18 KiB
Plaintext
196 lines
18 KiB
Plaintext
|
Ë
|
|||
|
|
îÅÙjsU ã
|
|||
|
|
ó” — d dl mZ d dlZd dlZd dlmZ d dlmZ d dlm Z d dl
|
|||
|
|
m Z g d¢Z dd gd gd gd
|
|||
|
|
œZ
|
|||
|
|
g Zg d ¢Zd j! e ed d
|
|||
|
|
« edd« edd« « D � cg c]
|
|||
|
|
} e| « ‘Œ c} « Z ej( dez dz ej* « ZdZ G d„ d« Zd„ Z G d„ de j4 « Zyc c} w )é )ÚchainN)Úurlparse)Úunescape)Ú
|
|||
|
|
html5lib_shim)Úalphabetize_attributes) ÚaÚabbrÚacronymÚbÚ
|
|||
|
|
blockquoteÚcodeÚemÚiÚliÚolÚstrongÚulÚhrefÚtitle)r r r
|
|||
|
|
)ÚhttpÚhttpsÚmailtoÚ é é é
|
|||
|
|
é é Ú[Ú]Ú?c ó, — e Zd ZdZeeeedddfd„Zd„ Z y)ÚCleanera¨ Cleaner for cleaning HTML fragments of malicious content
|
|||
|
|
|
|||
|
|
This cleaner is a security-focused function whose sole purpose is to remove
|
|||
|
|
malicious content from a string such that it can be displayed as content in
|
|||
|
|
a web page.
|
|||
|
|
|
|||
|
|
To use::
|
|||
|
|
|
|||
|
|
from bleach.sanitizer import Cleaner
|
|||
|
|
|
|||
|
|
cleaner = Cleaner()
|
|||
|
|
|
|||
|
|
for text in all_the_yucky_things:
|
|||
|
|
sanitized = cleaner.clean(text)
|
|||
|
|
|
|||
|
|
.. Note::
|
|||
|
|
|
|||
|
|
This cleaner is not designed to use to transform content to be used in
|
|||
|
|
non-web-page contexts.
|
|||
|
|
|
|||
|
|
.. Warning::
|
|||
|
|
|
|||
|
|
This cleaner is not thread-safe--the html parser has internal state.
|
|||
|
|
Create a separate cleaner per thread!
|
|||
|
|
|
|||
|
|
|
|||
|
|
FTNc óF — || _ || _ || _ || _ || _ || _ |xs g | _ t j | j | j dd¬« | _ t j d« | _ t j dddddd¬« | _
|
|||
|
|
y)a Initializes a Cleaner
|
|||
|
|
|
|||
|
|
:arg list tags: allowed list of tags; defaults to
|
|||
|
|
``bleach.sanitizer.ALLOWED_TAGS``
|
|||
|
|
|
|||
|
|
:arg dict attributes: allowed attributes; can be a callable, list or dict;
|
|||
|
|
defaults to ``bleach.sanitizer.ALLOWED_ATTRIBUTES``
|
|||
|
|
|
|||
|
|
:arg list styles: allowed list of css styles; defaults to
|
|||
|
|
``bleach.sanitizer.ALLOWED_STYLES``
|
|||
|
|
|
|||
|
|
:arg list protocols: allowed list of protocols for links; defaults
|
|||
|
|
to ``bleach.sanitizer.ALLOWED_PROTOCOLS``
|
|||
|
|
|
|||
|
|
:arg bool strip: whether or not to strip disallowed elements
|
|||
|
|
|
|||
|
|
:arg bool strip_comments: whether or not to strip HTML comments
|
|||
|
|
|
|||
|
|
:arg list filters: list of html5lib Filter classes to pass streamed content through
|
|||
|
|
|
|||
|
|
.. seealso:: http://html5lib.readthedocs.io/en/latest/movingparts.html#filters
|
|||
|
|
|
|||
|
|
.. Warning::
|
|||
|
|
|
|||
|
|
Using filters changes the output of ``bleach.Cleaner.clean``.
|
|||
|
|
Make sure the way the filters change the output are secure.
|
|||
|
|
|
|||
|
|
F)ÚtagsÚstripÚconsume_entitiesÚnamespaceHTMLElementsÚetreeÚalwaysT)Úquote_attr_valuesÚomit_optional_tagsÚescape_lt_in_attrsÚresolve_entitiesÚsanitizeÚalphabetical_attributesN)r% Ú
|
|||
|
|
attributesÚstylesÚ protocolsr& Ústrip_commentsÚfiltersr ÚBleachHTMLParserÚparserÚ
|
|||
|
|
getTreeWalkerÚwalkerÚBleachHTMLSerializerÚ
|
|||
|
|
serializer)Úselfr% r1 r2 r3 r& r4 r5 s úTC:\Users\30997\AppData\Local\Temp\pip-target-6g32zz5s\lib\python\bleach/sanitizer.pyÚ__init__zCleaner.__init__T s› € ðL ˆŒ Ø$ˆŒØ ˆŒ Ø"ˆŒØˆŒ
|
|||
|
|
Ø ,ˆÔØ ’} "ˆŒ ä#×4Ñ4Ø—‘Ø—*‘*Ø "Ø"'ô
|
|||
|
|
ˆŒ ô $×1Ñ1°'Ó:ˆŒ Ü'×<Ñ<Ø &Ø $Ø #ð #àà$)ô
|
|||
|
|
ˆ�ó c
|
|||
|
|
óæ — t |t « s1dj |j j ¬« }t |« ‚|sy| j j |« }t | j |« | j | j | j | j | j | j g ¬« }| j D ] } ||¬« }Œ
|
|||
|
|
| j" j% |« S )zÐCleans text and returns sanitized result as unicode
|
|||
|
|
|
|||
|
|
:arg str text: text to be cleaned
|
|||
|
|
|
|||
|
|
:returns: sanitized text as unicode
|
|||
|
|
|
|||
|
|
:raises TypeError: if ``text`` is not a text type
|
|||
|
|
|
|||
|
|
z9argument cannot be of '{name}' type, must be of text type)Únamer )Úsourcer1 Ústrip_disallowed_elementsÚstrip_html_commentsÚallowed_elementsÚallowed_css_propertiesÚallowed_protocolsÚallowed_svg_properties)rB )Ú
|
|||
|
|
isinstanceÚstrÚformatÚ __class__Ú__name__Ú TypeErrorr7 Ú
|
|||
|
|
parseFragmentÚBleachSanitizerFilterr9 r1 r& r4 r% r2 r3 r5 r; Úrender)r< ÚtextÚmessageÚdomÚfilteredÚ filter_classs r= Úcleanz
|
|||
|
|
Cleaner.clean– sÑ € ô ˜$¤Ô$àK×RÑRØ Ÿ ™ ×0Ñ0ð Só ð
|
|||
|
|
ô
|
|||
|
|
˜GÓ$Ð $áØà�k‰k×'Ñ'¨Ó-ˆÜ(Ø—;‘;˜sÓ#à—‘Ø&*§j¡jØ $× 3Ñ 3à !ŸY™YØ#'§;¡;Ø "Ÿn™nØ#%ô
|
|||
|
|
ˆð !ŸLœLˆLÙ#¨8Ô4‰Hð )ð �‰×%Ñ% hÓ/Ð/r? )
|
|||
|
|
rM Ú
|
|||
|
|
__module__Ú __qualname__Ú__doc__Ú ALLOWED_TAGSÚALLOWED_ATTRIBUTESÚALLOWED_STYLESÚALLOWED_PROTOCOLSr> rW © r? r= r# r# 7 s* „ ñð< Ø%Ø Ø#ØØØó@
|
|||
|
|
óD'0r? r# c ó� ‡ — t ‰ « r‰ S t ‰ t « rˆ fd„}|S t ‰ t « rˆ fd„}|S t d« ‚)a0 Generates attribute filter function for the given attributes value
|
|||
|
|
|
|||
|
|
The attributes value can take one of several shapes. This returns a filter
|
|||
|
|
function appropriate to the attributes value. One nice thing about this is
|
|||
|
|
that there's less if/then shenanigans in the ``allow_token`` method.
|
|||
|
|
|
|||
|
|
c ó� •— | ‰v r ‰| }t |« r
|
|||
|
|
|| ||« S ||v ryd‰v r ‰d }t |« r
|
|||
|
|
|| ||« S ||v S y)NTÚ*F)Úcallable)ÚtagÚattrÚvalueÚattr_valr1 s €r= Ú _attr_filterz.attribute_filter_factory.<locals>._attr_filterÍ sl ø€ Ø�jÑ Ø% c™?�ܘHÔ%Ù# C¨¨uÓ5Ð5à˜8Ñ#Ø à�jÑ Ø% c™?�ܘHÔ%Ù# C¨¨uÓ5Ð5à˜xÐ'Ð'àr? c ó •— |‰v S ©Nr_ )rd re rf r1 s €r= rh z.attribute_filter_factory.<locals>._attr_filterã s ø€ ؘ:Ð%Ð %r? z3attributes needs to be a callable, a list or a dict)rc rI ÚdictÚlistÚ
|
|||
|
|
ValueError)r1 rh s ` r= Úattribute_filter_factoryrn À sM ø€ ô �
|
|||
|
|
ÔØÐä�*œdÔ#ô ð$ Ðä�*œdÔ#ô &ð Ðä
|
|||
|
|
ÐJÓ
|
|||
|
|
KÐKr? c ó` ‡ — e Zd ZdZeddfˆ fd„ Zd„ Zd„ Zd„ Zd„ Z d „ Z
|
|||
|
|
d
|
|||
|
|
„ Z d „ Z d „ Z
|
|||
|
|
d
|
|||
|
|
„ Zˆ xZS )rP zmhtml5lib Filter that sanitizes text
|
|||
|
|
|
|||
|
|
This filter can be used anywhere html5lib filters can be used.
|
|||
|
|
|
|||
|
|
FTc ó¢ •— t |« | _ || _ || _ t j
|
|||
|
|
ddt d¬« t t | �& |fi |¤ŽS )a Creates a BleachSanitizerFilter instance
|
|||
|
|
|
|||
|
|
:arg Treewalker source: stream
|
|||
|
|
|
|||
|
|
:arg list tags: allowed list of tags; defaults to
|
|||
|
|
``bleach.sanitizer.ALLOWED_TAGS``
|
|||
|
|
|
|||
|
|
:arg dict attributes: allowed attributes; can be a callable, list or dict;
|
|||
|
|
defaults to ``bleach.sanitizer.ALLOWED_ATTRIBUTES``
|
|||
|
|
|
|||
|
|
:arg list styles: allowed list of css styles; defaults to
|
|||
|
|
``bleach.sanitizer.ALLOWED_STYLES``
|
|||
|
|
|
|||
|
|
:arg list protocols: allowed list of protocols for links; defaults
|
|||
|
|
to ``bleach.sanitizer.ALLOWED_PROTOCOLS``
|
|||
|
|
|
|||
|
|
:arg bool strip_disallowed_elements: whether or not to strip disallowed
|
|||
|
|
elements
|
|||
|
|
|
|||
|
|
:arg bool strip_html_comments: whether or not to strip HTML comments
|
|||
|
|
|
|||
|
|
Úignorez"html5lib's sanitizer is deprecatedzbleach._vendor.html5lib)rS ÚcategoryÚmodule)
|
|||
|
|
rn Ú attr_filterrC rD ÚwarningsÚfilterwarningsÚDeprecationWarningÚsuperrP r> )r< rB r1 rC rD ÚkwargsrL s €r= r> z BleachSanitizerFilter.__init__ò sX ø€ ô< 4°JÓ?ˆÔØ)BˆÔ&Ø#6ˆÔ ô × Ñ Ø Ø8Ü'Ø,õ
|
|||
|
|
ô Ô*¨DÑ:¸6ÑLÀVÑLÐLr? c # ó‚ K — |D ]6 }| j |« }|sŒt |t « r |D ] }|–— Œ Œ3|–— Œ8 y wrj )Úsanitize_tokenrI rl )r< Útoken_iteratorÚtokenÚretÚsubtokens r= Úsanitize_streamz%BleachSanitizerFilter.sanitize_stream sF è ø€ Û#ˆEØ×%Ñ% eÓ,ˆCáØä˜#œtÔ$Û #�HØ"“Nñ !$ð “ ñ $ùs ‚=?c # óP K — g }|D ]h }|rF|d dk( r|j |« Œ dj |D �cg c] }|d ‘Œ c}« ddœ}g }|–— n|d dk( r|j |« Œe|–— Œj dj |D �cg c] }|d ‘Œ c}« ddœ}|–— yc c}w c c}w w)z/Merge consecutive Characters tokens in a streamÚtypeÚ
|
|||
|
|
Charactersr Údata)r„ r‚ N)ÚappendÚjoin)r< r| Úcharacters_bufferr} Ú
|
|||
|
|
char_tokenÚ new_tokens r= Úmerge_charactersz&BleachSanitizerFilter.merge_characters* sÚ è ø€ à Ðã#ˆE٠ؘ‘= LÒ0Ø%×,Ñ,¨UÔ3Ø ð
|
|||
|
|
!#§¡ÙBSÓ TÑBS°J˜Z¨Ó /ÐBSÑ Tó!ð !-ñ !�Ið )+Ð%Ø#“Oà�v‘ ,Ò.Ø!×(Ñ(¨Ô/Øà‹Kð+ $ð0 —G‘GÑBSÓ TÑBS°J˜Z¨Ó /ÐBSÑ TÓUØ ñ
|
|||
|
|
ˆ ð ‹ùò# Uùò Uùs ‚3B&µ B
|
|||
|
|
ÁA B&Â B!Â
|
|||
|
|
B&c ó| — | j | j t j j | « « « S rj )rŠ r€ r ÚFilterÚ__iter__)r< s r= r� z BleachSanitizerFilter.__iter__K s4 € Ø×$Ñ$Ø × Ñ ¤ ×!5Ñ!5×!>Ñ!>¸tÓ!DÓ Eó
|
|||
|
|
ð
|
|||
|
|
r? c óV — |d }|dv rU|d | j v r| j |« S | j ryd|v rt |d « |d< | j |« S |dk( r/| j
|
|||
|
|
s"t
|
|||
|
|
j |d ddd œ¬
|
|||
|
|
« |d< |S y|d k( r| j |« S |S ) aÕ Sanitize a token either by HTML-encoding or dropping.
|
|||
|
|
|
|||
|
|
Unlike sanitizer.Filter, allowed_attributes can be a dict of {'tag':
|
|||
|
|
['attribute', 'pairs'], 'tag': callable}.
|
|||
|
|
|
|||
|
|
Here callable is a function with two arguments of attribute name and
|
|||
|
|
value. It should return true of false.
|
|||
|
|
|
|||
|
|
Also gives the option to strip tags instead of encoding.
|
|||
|
|
|
|||
|
|
:arg dict token: token to sanitize
|
|||
|
|
|
|||
|
|
:returns: token or list of tokens
|
|||
|
|
|
|||
|
|
r‚ )ÚStartTagÚEndTagÚEmptyTagrA Nr„ ÚCommentz"z')Ú"Ú')Úentitiesrƒ ) rE Ú allow_tokenrC r Údisallowed_tokenrD r ÚescapeÚsanitize_characters)r< r} Ú
|
|||
|
|
token_types r= r{ z$BleachSanitizerFilter.sanitize_tokenP sÐ € ð ˜6‘]ˆ
|
|||
|
|
Ø Ð;Ñ ;Ø�V‰} × 5Ñ 5Ñ5Ø×'Ñ'¨Ó.Ð.à×/Ò/Øð ˜U‘?ô %;¸5À¹=Ó$I�E˜&‘MØ×,Ñ,¨UÓ3Ð3à
|
|||
|
|
˜9Ò
|
|||
|
|
$Ø×+Ò+ä -× 4Ñ 4ؘ&‘M°(ÀÑ,Jô!��f‘
|
|||
|
|
ð � àà
|
|||
|
|
˜<Ò
|
|||
|
|
'Ø×+Ñ+¨EÓ2Ð 2ð ˆLr? c óÞ — |j dd« }|s|S t j t |« }||d< d|vr|S g }t j
|
|||
|
|
|« D ]— }|sŒ|j
|
|||
|
|
d« rmt j |« }|�V|dk( r|j dddœ« n|j d|d œ« |t |« d
|
|||
|
|
z d }|r|j d|dœ« Œ„|j d|dœ« Œ™ |S ) a½ Handles Characters tokens
|
|||
|
|
|
|||
|
|
Our overridden tokenizer doesn't do anything with entities. However,
|
|||
|
|
that means that the serializer will convert all ``&`` in Characters
|
|||
|
|
tokens to ``&``.
|
|||
|
|
|
|||
|
|
Since we don't want that, we extract entities here and convert them to
|
|||
|
|
Entity tokens so the serializer will let them be.
|
|||
|
|
|
|||
|
|
:arg token: the Characters token to work on
|
|||
|
|
|
|||
|
|
:returns: a list of tokens
|
|||
|
|
|
|||
|
|
r„ r Ú&NÚamprƒ )r‚ r„ ÚEntity)r‚ rA é )
|
|||
|
|
ÚgetÚINVISIBLE_CHARACTERS_REÚsubÚINVISIBLE_REPLACEMENT_CHARr Únext_possible_entityÚ
|
|||
|
|
startswithÚ match_entityr… Úlen)r< r} r„ Ú
|
|||
|
|
new_tokensÚpartÚentityÚ remainders r= r™ z)BleachSanitizerFilter.sanitize_characters s € ð �y‰y˜ Ó$ˆá؈Lä&×*Ñ*Ô+EÀtÓLˆØ ˆˆf‰
|
|||
|
|
ð �d‰?؈Làˆ
|
|||
|
|
ô "×6Ñ6°tÖ<ˆDÙØà�‰˜sÔ#Ü&×3Ñ3°DÓ9�ØÐ%Ø ’ð #×)Ñ)°<ÈÑ*MÕNà"×)Ñ)°8ÀVÑ*LÔMð !%¤S¨£[°1¡_Ð%6Ð 7�IÙ Ø"×)Ñ)°<ÈÑ*SÔTØ à × Ñ |¸TÑ BÕ Cð5 =ð8 Ðr? c óz — t j |« }t j dd|« }|j dd« }|j « } t
|
|||
|
|
|« }|j r|j |v r|S y|j d« r|S d|v r|j d« d |v r|S d|v r|S y# t $ r Y yw xY w) zÅChecks a uri value to see if it's allowed
|
|||
|
|
|
|||
|
|
:arg value: the uri value to sanitize
|
|||
|
|
:arg allowed_protocols: list of allowed protocols
|
|||
|
|
|
|||
|
|
:returns: allowed value or None
|
|||
|
|
|
|||
|
|
z[`\000-\040\177-\240\s]+r u �NÚ#Ú:r r ) r Úconvert_entitiesÚrer¢ ÚreplaceÚlowerr rm Úschemer¥ Úsplit)r< rf rG Ú new_valueÚparseds r= Úsanitize_uri_valuez(BleachSanitizerFilter.sanitize_uri_value¼ sÝ € ô "×2Ñ2°5Ó9ˆ ô —F‘FÐ6¸¸IÓFˆ ð ×%Ñ% h°Ó3ˆ ð —O‘OÓ%ˆ ð ô ˜iÓ(ˆFð
|