mirror of
https://github.com/askama-rs/askama.git
synced 2025-09-30 06:21:13 +00:00
29f0c0607a
Previously the built-in json filter had an issue that made it unsafe to
use in HTML data. When used in HTML attributes an attacker who is able
to supply an arbitrary string that should be JSON encoded could close
the containing HTML element e.g. with `"</div>"`, and write arbitrary
HTML code afterwards as long as they use apostrophes instead of
quotation marks. The programmer could make this use case safe by
explicitly escaping the JSON result: `{{data|json|escape}}`.
In a `<script>` context the json filter was not usable at all, because
in scripts HTML escaped entities are not parsed outside of XHTML
documents. Without using the safe filter an attacker could close the
current script using `"</script>"`.
This PR fixes the problem by always escaping less-than, greater-than,
ampersand, and apostrophe characters using their JSON unicode escape
sequence `\u00xx`. Unless the programmer explicitly uses the safe
filter, quotation marks are HTML encoded as `"`. In scripts the
programmer should use the safe filter, otherwise not.
313 lines
6.8 KiB
Rust
313 lines
6.8 KiB
Rust
#![allow(clippy::blacklisted_name)]
|
|
|
|
#[cfg(feature = "serde-json")]
|
|
#[macro_use]
|
|
extern crate serde_json;
|
|
|
|
use askama::Template;
|
|
#[cfg(feature = "serde-json")]
|
|
use serde_json::Value;
|
|
|
|
#[derive(Template)]
|
|
#[template(path = "filters.html")]
|
|
struct TestTemplate {
|
|
strvar: String,
|
|
}
|
|
|
|
#[test]
|
|
fn filter_escape() {
|
|
let s = TestTemplate {
|
|
strvar: "// my <html> is \"unsafe\" & should be 'escaped'".to_string(),
|
|
};
|
|
assert_eq!(
|
|
s.render().unwrap(),
|
|
"// my <html> is "unsafe" & \
|
|
should be 'escaped'"
|
|
);
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(
|
|
source = "{{ \"<h1 class=\\\"title\\\">Foo Bar</h1>\"|escape(\"none\") }}
|
|
{{ \"<h1 class=\\\"title\\\">Foo Bar</h1>\"|escape(\"html\") }}
|
|
{{ \"<h1 class=\\\"title\\\">Foo Bar</h1>\"|escape }}
|
|
{{ \"<h1 class=\\\"title\\\">Foo Bar</h1>\" }}
|
|
",
|
|
ext = "txt",
|
|
escape = "none"
|
|
)]
|
|
struct OptEscaperNoneTemplate;
|
|
|
|
#[test]
|
|
fn filter_opt_escaper_none() {
|
|
let t = OptEscaperNoneTemplate;
|
|
assert_eq!(
|
|
t.render().unwrap(),
|
|
r#"<h1 class="title">Foo Bar</h1>
|
|
<h1 class="title">Foo Bar</h1>
|
|
<h1 class="title">Foo Bar</h1>
|
|
<h1 class="title">Foo Bar</h1>"#
|
|
);
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(
|
|
source = "{{ \"<h1 class=\\\"title\\\">Foo Bar</h1>\"|escape(\"none\") }}
|
|
{{ \"<h1 class=\\\"title\\\">Foo Bar</h1>\"|escape(\"html\") }}
|
|
{{ \"<h1 class=\\\"title\\\">Foo Bar</h1>\"|escape }}
|
|
{{ \"<h1 class=\\\"title\\\">Foo Bar</h1>\" }}
|
|
",
|
|
ext = "txt",
|
|
escape = "html"
|
|
)]
|
|
struct OptEscaperHtmlTemplate;
|
|
|
|
#[test]
|
|
fn filter_opt_escaper_html() {
|
|
let t = OptEscaperHtmlTemplate;
|
|
assert_eq!(
|
|
t.render().unwrap(),
|
|
r#"<h1 class="title">Foo Bar</h1>
|
|
<h1 class="title">Foo Bar</h1>
|
|
<h1 class="title">Foo Bar</h1>
|
|
<h1 class="title">Foo Bar</h1>"#
|
|
);
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(path = "format.html", escape = "none")]
|
|
struct FormatTemplate<'a> {
|
|
var: &'a str,
|
|
}
|
|
|
|
#[test]
|
|
fn filter_format() {
|
|
let t = FormatTemplate { var: "formatted" };
|
|
assert_eq!(t.render().unwrap(), "\"formatted\"");
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(source = "{{ var|fmt(\"{:?}\") }}", ext = "html", escape = "none")]
|
|
struct FmtTemplate<'a> {
|
|
var: &'a str,
|
|
}
|
|
|
|
#[test]
|
|
fn filter_fmt() {
|
|
let t = FmtTemplate { var: "formatted" };
|
|
assert_eq!(t.render().unwrap(), "\"formatted\"");
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(
|
|
source = "{{ 1|into_f64 }} {{ 1.9|into_isize }}",
|
|
ext = "txt",
|
|
escape = "none"
|
|
)]
|
|
struct IntoNumbersTemplate;
|
|
|
|
#[test]
|
|
fn into_numbers_fmt() {
|
|
let t = IntoNumbersTemplate;
|
|
assert_eq!(t.render().unwrap(), "1 1");
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(source = "{{ s|myfilter }}", ext = "txt")]
|
|
struct MyFilterTemplate<'a> {
|
|
s: &'a str,
|
|
}
|
|
|
|
mod filters {
|
|
pub fn myfilter(s: &str) -> ::askama::Result<String> {
|
|
Ok(s.replace("oo", "aa"))
|
|
}
|
|
// for test_nested_filter_ref
|
|
pub fn mytrim(s: &dyn (::std::fmt::Display)) -> ::askama::Result<String> {
|
|
let s = format!("{}", s);
|
|
Ok(s.trim().to_owned())
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn test_my_filter() {
|
|
let t = MyFilterTemplate { s: "foo" };
|
|
assert_eq!(t.render().unwrap(), "faa");
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(path = "filters_join.html")]
|
|
struct JoinTemplate<'a> {
|
|
s: &'a [&'a str],
|
|
}
|
|
|
|
#[test]
|
|
fn test_join() {
|
|
let t = JoinTemplate {
|
|
s: &["foo", "bar", "bazz"],
|
|
};
|
|
assert_eq!(t.render().unwrap(), "foo, bar, bazz");
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(path = "filters_join.html")]
|
|
struct VecJoinTemplate {
|
|
s: Vec<String>,
|
|
}
|
|
|
|
#[test]
|
|
fn test_vec_join() {
|
|
let t = VecJoinTemplate {
|
|
s: vec!["foo".into(), "bar".into(), "bazz".into()],
|
|
};
|
|
assert_eq!(t.render().unwrap(), "foo, bar, bazz");
|
|
}
|
|
|
|
#[cfg(feature = "serde-json")]
|
|
#[derive(Template)]
|
|
#[template(path = "json.html")]
|
|
struct JsonTemplate<'a> {
|
|
foo: &'a str,
|
|
bar: &'a Value,
|
|
}
|
|
|
|
#[cfg(feature = "serde-json")]
|
|
#[test]
|
|
fn test_json() {
|
|
let val = json!({"arr": [ "one", 2, true, null ]});
|
|
let t = JsonTemplate {
|
|
foo: "a",
|
|
bar: &val,
|
|
};
|
|
// Note: the json filter lacks a way to specify initial indentation
|
|
assert_eq!(
|
|
t.render().unwrap(),
|
|
r#"{
|
|
"foo": "a",
|
|
"bar": {
|
|
"arr": [
|
|
"one",
|
|
2,
|
|
true,
|
|
null
|
|
]
|
|
}
|
|
}"#
|
|
);
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(source = "{{ x|mytrim|safe }}", ext = "html")]
|
|
struct NestedFilterTemplate {
|
|
x: String,
|
|
}
|
|
|
|
#[test]
|
|
fn test_nested_filter_ref() {
|
|
let t = NestedFilterTemplate {
|
|
x: " floo & bar".to_string(),
|
|
};
|
|
assert_eq!(t.render().unwrap(), "floo & bar");
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(
|
|
source = "{% let p = baz.print(foo.as_ref()) %}{{ p|upper }}",
|
|
ext = "html"
|
|
)]
|
|
struct FilterLetFilterTemplate {
|
|
foo: String,
|
|
baz: Baz,
|
|
}
|
|
|
|
struct Baz {}
|
|
|
|
impl Baz {
|
|
fn print(&self, s: &str) -> String {
|
|
s.trim().to_owned()
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn test_filter_let_filter() {
|
|
let t = FilterLetFilterTemplate {
|
|
foo: " bar ".to_owned(),
|
|
baz: Baz {},
|
|
};
|
|
assert_eq!(t.render().unwrap(), "BAR");
|
|
}
|
|
|
|
#[derive(Template)]
|
|
#[template(source = "{{ foo|truncate(10) }}{{ foo|truncate(5) }}", ext = "txt")]
|
|
struct TruncateFilter {
|
|
foo: String,
|
|
}
|
|
|
|
#[test]
|
|
fn test_filter_truncate() {
|
|
let t = TruncateFilter {
|
|
foo: "alpha bar".into(),
|
|
};
|
|
assert_eq!(t.render().unwrap(), "alpha baralpha...");
|
|
}
|
|
|
|
#[cfg(feature = "serde-json")]
|
|
#[derive(Template)]
|
|
#[template(source = r#"<li data-name="{{name|json}}"></li>"#, ext = "html")]
|
|
struct JsonAttributeTemplate<'a> {
|
|
name: &'a str,
|
|
}
|
|
|
|
#[cfg(feature = "serde-json")]
|
|
#[test]
|
|
fn test_json_attribute() {
|
|
let t = JsonAttributeTemplate {
|
|
name: r#""><button>Hacked!</button>"#,
|
|
};
|
|
assert_eq!(
|
|
t.render().unwrap(),
|
|
r#"<li data-name=""\"\u003e\u003cbutton\u003eHacked!\u003c/button\u003e""></li>"#
|
|
);
|
|
}
|
|
|
|
#[cfg(feature = "serde-json")]
|
|
#[derive(Template)]
|
|
#[template(source = r#"<li data-name='{{name|json|safe}}'></li>"#, ext = "html")]
|
|
struct JsonAttribute2Template<'a> {
|
|
name: &'a str,
|
|
}
|
|
|
|
#[cfg(feature = "serde-json")]
|
|
#[test]
|
|
fn test_json_attribute2() {
|
|
let t = JsonAttribute2Template {
|
|
name: r#"'><button>Hacked!</button>"#,
|
|
};
|
|
assert_eq!(
|
|
t.render().unwrap(),
|
|
r#"<li data-name='"\u0027\u003e\u003cbutton\u003eHacked!\u003c/button\u003e"'></li>"#
|
|
);
|
|
}
|
|
|
|
#[cfg(feature = "serde-json")]
|
|
#[derive(Template)]
|
|
#[template(
|
|
source = r#"<script>var user = {{name|json|safe}}</script>"#,
|
|
ext = "html"
|
|
)]
|
|
struct JsonScriptTemplate<'a> {
|
|
name: &'a str,
|
|
}
|
|
|
|
#[cfg(feature = "serde-json")]
|
|
#[test]
|
|
fn test_json_script() {
|
|
let t = JsonScriptTemplate {
|
|
name: r#"</script><button>Hacked!</button>"#,
|
|
};
|
|
assert_eq!(
|
|
t.render().unwrap(),
|
|
r#"<script>var user = "\u003c/script\u003e\u003cbutton\u003eHacked!\u003c/button\u003e"</script>"#
|
|
);
|
|
}
|