Changes between Version 74 and Version 75 of GenshiTutorial

Timestamp:

Sep 4, 2007, 9:19:37 PM (17 years ago)

Author:

cmlenz

Comment:

--

GenshiTutorial

@@ -1424 +1424 @@
 This parses the comment text, runs it through the sanitizer, and serializes it to XHTML. And the result of the transformation is what we'll save to our “database”. Why are we using XHTML here, when we actually use HTML almost everywhere else? Well, we want to be able to include the comment text in Atom feeds, too, and for that they'll need to be well-formed XML.
 
+You may want to try performing some XSS attacks by including malicious HTML markup in comments. Try some of the methods shown on the [http://ha.ckers.org/xss.html XSS Cheat Sheet]. You should not be able to get past the sanitizer; if you are, please [/newticket let us now].
+
+Speaking of the Atom feed, let's update the corresponding template so that it, too, includes the user-submitted HTML tags as markup, instead of as escaped text. Open `geddit/templates/info.xml`, and update it to look as follows:
+
+{{{
+#!genshi
+<?xml version="1.0" encoding="utf-8"?>
+<feed xmlns="http://www.w3.org/2005/Atom"
+      xmlns:py="http://genshi.edgewall.org/">
+
+  <title>Geddit: ${link.title}</title>
+  <id href="${url('/info/%s/' % link.id)}"/>
+  <link rel="alternate" href="${url('/info/%s/' % link.id)}" type="text/html"/>
+  <link rel="self" href="${url('/feed/%s/' % link.id)}" type="application/atom+xml"/>
+  <updated py:with="time=link.comments and link.comments[-1].time or link.time">
+    ${time.isoformat()}
+  </updated>
+
+  <?python from genshi import HTML ?>
+  <entry py:for="idx, comment in enumerate(reversed(link.comments))">
+    <title>Comment ${len(link.comments) - idx} on “${link.title}”</title>
+    <link rel="alternate" href="${url('/info/%s/' % link.id)}#comment${idx}"
+          type="text/html"/>
+    <id>${url('/info/%s/' % link.id)}#comment${idx}</id>
+    <author>
+      <name>${comment.username}</name>
+    </author>
+    <updated>${comment.time.isoformat()}</updated>
+    <content type="xhtml"><div xmlns="http://www.w3.org/1999/xhtml">
+      ${HTML(comment.content)}
+    </div></content>
+  </entry>
+
+</feed>
+}}}
+
+As above, we've added the import of the Genshi `HTML()` function. On the `<content>` element we've added the `type="xhtml"` attribute, and we've added a wrapper `<div>` inside it to declare the XHTML namespace. Finally, inside that `<div>`, we inject the comment text as an HTML-parsed stream, analogous to what we've done in the HTML template.