{"action":"created","comment":{"url":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/comments/234208287","pull_request_review_id":175806673,"id":234208287,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzNDIwODI4Nw==","diff_hunk":"@@ -1,100 +1,116 @@\n-import pytest\n+from textwrap import dedent\n \n-import naucse.validation\n+import pytest\n \n+import naucse.sanitize\n+from naucse.sanitize import sanitize_html\n \n-def test_allowed_elements():\n-    allowed_elements = naucse.validation.AllowedElementsParser()\n+def assert_changed(input_html, expected):\n+    input_html = dedent(input_html).strip()\n+    expected = dedent(expected).strip()\n+    output_html = sanitize_html(input_html)\n+    assert output_html == expected\n \n-    allowed_elements.reset_and_feed(\n-        \"<div><strong><u><a>Test</a></u></div>\"\n-    )\n \n-    with pytest.raises(naucse.validation.DisallowedElement):\n-        allowed_elements.reset_and_feed(\n-            \"<div><script>alert('XSS')</script></div>\"\n-        )\n+def assert_unchanged(input_html):\n+    assert_changed(input_html, input_html)\n \n \n-def test_allow_attributes():\n-    allowed_elements = naucse.validation.AllowedElementsParser()\n-\n-    allowed_elements.reset_and_feed(\n-        \"<div class='test'><span style='color: red'><a href='/courses/'>Text</a></span></div>\"\n+def test_allowed_elements():\n+    assert_changed(\n+        \"<div><strong><u><a>Test</a></u></div>\",\n+        \"<div><strong><u><a>Test</a></u></strong></div>\",\n     )\n \n-    with pytest.raises(naucse.validation.DisallowedElement):\n-        allowed_elements.reset_and_feed(\n-            \"\"\"<div class='test' onhover=\"alert('XSS')\"><a href='/courses/'>Text</a></div>\"\"\"\n+def test_disallow_script():\n+    with pytest.raises(naucse.sanitize.DisallowedElement):\n+        sanitize_html(\n+            \"<div><script>alert('XSS')</script></div>\"\n         )\n \n-    with pytest.raises(naucse.validation.DisallowedElement):\n-        allowed_elements.reset_and_feed(\n-            \"\"\"<div class='test'><span style='color: red'><a href=\"javascript:alert('XSS')\">Text</a></span></div>\"\"\"\n-        )\n \n-    with pytest.raises(naucse.validation.DisallowedElement):\n-        allowed_elements.reset_and_feed(\n-            \"\"\"<div class='test' onhover=\"alert('XSS')\"><img src=\"javascript:alert('XSS')\" /></div>\"\"\"\n+def test_allow_attributes():\n+    assert_unchanged(\"\"\"\n+        <div class=\"test\">\n+            <span><a href=\"/courses/\">Text</a></span>\n+        </div>\n+    \"\"\")\n+\n+def test_disallow_onhover():\n+    with pytest.raises(naucse.sanitize.DisallowedAttribute):\n+        sanitize_html(\"\"\"\n+            <div class=\"test\" onhover=\"alert('XSS')\">\n+                <a href=\"/courses/\">Text</a>\n+            </div>\n+        \"\"\")\n+\n+@pytest.mark.xfail","path":"test_naucse/test_validation.py","position":73,"original_position":73,"commit_id":"090ba936605f8a583103998e4021d6ec9a54e148","original_commit_id":"090ba936605f8a583103998e4021d6ec9a54e148","user":{"login":"encukou","id":302922,"node_id":"MDQ6VXNlcjMwMjkyMg==","avatar_url":"https://avatars1.githubusercontent.com/u/302922?v=4","gravatar_id":"","url":"https://api.github.com/users/encukou","html_url":"https://github.com/encukou","followers_url":"https://api.github.com/users/encukou/followers","following_url":"https://api.github.com/users/encukou/following{/other_user}","gists_url":"https://api.github.com/users/encukou/gists{/gist_id}","starred_url":"https://api.github.com/users/encukou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/encukou/subscriptions","organizations_url":"https://api.github.com/users/encukou/orgs","repos_url":"https://api.github.com/users/encukou/repos","events_url":"https://api.github.com/users/encukou/events{/privacy}","received_events_url":"https://api.github.com/users/encukou/received_events","type":"User","site_admin":false},"body":"Yes.","created_at":"2018-11-16T13:47:55Z","updated_at":"2018-11-16T13:47:56Z","html_url":"https://github.com/pyvec/naucse.python.cz/pull/489#discussion_r234208287","pull_request_url":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/489","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/comments/234208287"},"html":{"href":"https://github.com/pyvec/naucse.python.cz/pull/489#discussion_r234208287"},"pull_request":{"href":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/489"}},"in_reply_to_id":234206773},"pull_request":{"url":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/489","id":231514007,"node_id":"MDExOlB1bGxSZXF1ZXN0MjMxNTE0MDA3","html_url":"https://github.com/pyvec/naucse.python.cz/pull/489","diff_url":"https://github.com/pyvec/naucse.python.cz/pull/489.diff","patch_url":"https://github.com/pyvec/naucse.python.cz/pull/489.patch","issue_url":"https://api.github.com/repos/pyvec/naucse.python.cz/issues/489","number":489,"state":"open","locked":false,"title":"Replace the HTML validator by a sanitizer based on lxml DOM","user":{"login":"encukou","id":302922,"node_id":"MDQ6VXNlcjMwMjkyMg==","avatar_url":"https://avatars1.githubusercontent.com/u/302922?v=4","gravatar_id":"","url":"https://api.github.com/users/encukou","html_url":"https://github.com/encukou","followers_url":"https://api.github.com/users/encukou/followers","following_url":"https://api.github.com/users/encukou/following{/other_user}","gists_url":"https://api.github.com/users/encukou/gists{/gist_id}","starred_url":"https://api.github.com/users/encukou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/encukou/subscriptions","organizations_url":"https://api.github.com/users/encukou/orgs","repos_url":"https://api.github.com/users/encukou/repos","events_url":"https://api.github.com/users/encukou/events{/privacy}","received_events_url":"https://api.github.com/users/encukou/received_events","type":"User","site_admin":false},"body":"As I'm working to decouple the content (forks) with its presentation (the website), I'm struggling with the fact that URL structure is baked into the HTML that comes out of the forks. I'd like to eventually add a way to adjust the links on naucse side.\r\nThat will require parsing the HTML. We already do that to validate it. Let's not do it twice.\r\n\r\nThis replaces the validator with a \"sanitizer\" that currently does the same thing, but will allows adjusting the HTML.\r\n\r\nAnother benefit should be that as we grow better validation, we'll be able to *remove* bad HTML from pre-existing forks, rather than stop rendering the fork or be forced to change it.\r\n","created_at":"2018-11-16T12:25:15Z","updated_at":"2018-11-16T13:47:56Z","closed_at":null,"merged_at":null,"merge_commit_sha":"23498042b811a0979259da893a5c873cc7fde2b0","assignee":null,"assignees":[],"requested_reviewers":[{"login":"mikicz","id":5583319,"node_id":"MDQ6VXNlcjU1ODMzMTk=","avatar_url":"https://avatars3.githubusercontent.com/u/5583319?v=4","gravatar_id":"","url":"https://api.github.com/users/mikicz","html_url":"https://github.com/mikicz","followers_url":"https://api.github.com/users/mikicz/followers","following_url":"https://api.github.com/users/mikicz/following{/other_user}","gists_url":"https://api.github.com/users/mikicz/gists{/gist_id}","starred_url":"https://api.github.com/users/mikicz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikicz/subscriptions","organizations_url":"https://api.github.com/users/mikicz/orgs","repos_url":"https://api.github.com/users/mikicz/repos","events_url":"https://api.github.com/users/mikicz/events{/privacy}","received_events_url":"https://api.github.com/users/mikicz/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[{"id":620011047,"node_id":"MDU6TGFiZWw2MjAwMTEwNDc=","url":"https://api.github.com/repos/pyvec/naucse.python.cz/labels/code","name":"code","color":"bfdadc","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/489/commits","review_comments_url":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/489/comments","review_comment_url":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/comments{/number}","comments_url":"https://api.github.com/repos/pyvec/naucse.python.cz/issues/489/comments","statuses_url":"https://api.github.com/repos/pyvec/naucse.python.cz/statuses/090ba936605f8a583103998e4021d6ec9a54e148","head":{"label":"encukou:sanitize","ref":"sanitize","sha":"090ba936605f8a583103998e4021d6ec9a54e148","user":{"login":"encukou","id":302922,"node_id":"MDQ6VXNlcjMwMjkyMg==","avatar_url":"https://avatars1.githubusercontent.com/u/302922?v=4","gravatar_id":"","url":"https://api.github.com/users/encukou","html_url":"https://github.com/encukou","followers_url":"https://api.github.com/users/encukou/followers","following_url":"https://api.github.com/users/encukou/following{/other_user}","gists_url":"https://api.github.com/users/encukou/gists{/gist_id}","starred_url":"https://api.github.com/users/encukou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/encukou/subscriptions","organizations_url":"https://api.github.com/users/encukou/orgs","repos_url":"https://api.github.com/users/encukou/repos","events_url":"https://api.github.com/users/encukou/events{/privacy}","received_events_url":"https://api.github.com/users/encukou/received_events","type":"User","site_admin":false},"repo":{"id":69355392,"node_id":"MDEwOlJlcG9zaXRvcnk2OTM1NTM5Mg==","name":"naucse.python.cz","full_name":"encukou/naucse.python.cz","private":false,"owner":{"login":"encukou","id":302922,"node_id":"MDQ6VXNlcjMwMjkyMg==","avatar_url":"https://avatars1.githubusercontent.com/u/302922?v=4","gravatar_id":"","url":"https://api.github.com/users/encukou","html_url":"https://github.com/encukou","followers_url":"https://api.github.com/users/encukou/followers","following_url":"https://api.github.com/users/encukou/following{/other_user}","gists_url":"https://api.github.com/users/encukou/gists{/gist_id}","starred_url":"https://api.github.com/users/encukou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/encukou/subscriptions","organizations_url":"https://api.github.com/users/encukou/orgs","repos_url":"https://api.github.com/users/encukou/repos","events_url":"https://api.github.com/users/encukou/events{/privacy}","received_events_url":"https://api.github.com/users/encukou/received_events","type":"User","site_admin":false},"html_url":"https://github.com/encukou/naucse.python.cz","description":"Website with learning materials / Stránka s učebními materiály","fork":true,"url":"https://api.github.com/repos/encukou/naucse.python.cz","forks_url":"https://api.github.com/repos/encukou/naucse.python.cz/forks","keys_url":"https://api.github.com/repos/encukou/naucse.python.cz/keys{/key_id}","collaborators_url":"https://api.github.com/repos/encukou/naucse.python.cz/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/encukou/naucse.python.cz/teams","hooks_url":"https://api.github.com/repos/encukou/naucse.python.cz/hooks","issue_events_url":"https://api.github.com/repos/encukou/naucse.python.cz/issues/events{/number}","events_url":"https://api.github.com/repos/encukou/naucse.python.cz/events","assignees_url":"https://api.github.com/repos/encukou/naucse.python.cz/assignees{/user}","branches_url":"https://api.github.com/repos/encukou/naucse.python.cz/branches{/branch}","tags_url":"https://api.github.com/repos/encukou/naucse.python.cz/tags","blobs_url":"https://api.github.com/repos/encukou/naucse.python.cz/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/encukou/naucse.python.cz/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/encukou/naucse.python.cz/git/refs{/sha}","trees_url":"https://api.github.com/repos/encukou/naucse.python.cz/git/trees{/sha}","statuses_url":"https://api.github.com/repos/encukou/naucse.python.cz/statuses/{sha}","languages_url":"https://api.github.com/repos/encukou/naucse.python.cz/languages","stargazers_url":"https://api.github.com/repos/encukou/naucse.python.cz/stargazers","contributors_url":"https://api.github.com/repos/encukou/naucse.python.cz/contributors","subscribers_url":"https://api.github.com/repos/encukou/naucse.python.cz/subscribers","subscription_url":"https://api.github.com/repos/encukou/naucse.python.cz/subscription","commits_url":"https://api.github.com/repos/encukou/naucse.python.cz/commits{/sha}","git_commits_url":"https://api.github.com/repos/encukou/naucse.python.cz/git/commits{/sha}","comments_url":"https://api.github.com/repos/encukou/naucse.python.cz/comments{/number}","issue_comment_url":"https://api.github.com/repos/encukou/naucse.python.cz/issues/comments{/number}","contents_url":"https://api.github.com/repos/encukou/naucse.python.cz/contents/{+path}","compare_url":"https://api.github.com/repos/encukou/naucse.python.cz/compare/{base}...{head}","merges_url":"https://api.github.com/repos/encukou/naucse.python.cz/merges","archive_url":"https://api.github.com/repos/encukou/naucse.python.cz/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/encukou/naucse.python.cz/downloads","issues_url":"https://api.github.com/repos/encukou/naucse.python.cz/issues{/number}","pulls_url":"https://api.github.com/repos/encukou/naucse.python.cz/pulls{/number}","milestones_url":"https://api.github.com/repos/encukou/naucse.python.cz/milestones{/number}","notifications_url":"https://api.github.com/repos/encukou/naucse.python.cz/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/encukou/naucse.python.cz/labels{/name}","releases_url":"https://api.github.com/repos/encukou/naucse.python.cz/releases{/id}","deployments_url":"https://api.github.com/repos/encukou/naucse.python.cz/deployments","created_at":"2016-09-27T12:43:08Z","updated_at":"2018-09-06T08:18:53Z","pushed_at":"2018-11-16T13:13:17Z","git_url":"git://github.com/encukou/naucse.python.cz.git","ssh_url":"git@github.com:encukou/naucse.python.cz.git","clone_url":"https://github.com/encukou/naucse.python.cz.git","svn_url":"https://github.com/encukou/naucse.python.cz","homepage":"http://naucse.python.cz","size":55710,"stargazers_count":0,"watchers_count":0,"language":"Jupyter Notebook","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":1,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"pyvec:master","ref":"master","sha":"67373bd20d294ef58d72be1b6cf0981311accc9d","user":{"login":"pyvec","id":791768,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc5MTc2OA==","avatar_url":"https://avatars1.githubusercontent.com/u/791768?v=4","gravatar_id":"","url":"https://api.github.com/users/pyvec","html_url":"https://github.com/pyvec","followers_url":"https://api.github.com/users/pyvec/followers","following_url":"https://api.github.com/users/pyvec/following{/other_user}","gists_url":"https://api.github.com/users/pyvec/gists{/gist_id}","starred_url":"https://api.github.com/users/pyvec/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pyvec/subscriptions","organizations_url":"https://api.github.com/users/pyvec/orgs","repos_url":"https://api.github.com/users/pyvec/repos","events_url":"https://api.github.com/users/pyvec/events{/privacy}","received_events_url":"https://api.github.com/users/pyvec/received_events","type":"Organization","site_admin":false},"repo":{"id":66144421,"node_id":"MDEwOlJlcG9zaXRvcnk2NjE0NDQyMQ==","name":"naucse.python.cz","full_name":"pyvec/naucse.python.cz","private":false,"owner":{"login":"pyvec","id":791768,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc5MTc2OA==","avatar_url":"https://avatars1.githubusercontent.com/u/791768?v=4","gravatar_id":"","url":"https://api.github.com/users/pyvec","html_url":"https://github.com/pyvec","followers_url":"https://api.github.com/users/pyvec/followers","following_url":"https://api.github.com/users/pyvec/following{/other_user}","gists_url":"https://api.github.com/users/pyvec/gists{/gist_id}","starred_url":"https://api.github.com/users/pyvec/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pyvec/subscriptions","organizations_url":"https://api.github.com/users/pyvec/orgs","repos_url":"https://api.github.com/users/pyvec/repos","events_url":"https://api.github.com/users/pyvec/events{/privacy}","received_events_url":"https://api.github.com/users/pyvec/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/pyvec/naucse.python.cz","description":"Website with learning materials / Stránka s učebními materiály","fork":false,"url":"https://api.github.com/repos/pyvec/naucse.python.cz","forks_url":"https://api.github.com/repos/pyvec/naucse.python.cz/forks","keys_url":"https://api.github.com/repos/pyvec/naucse.python.cz/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pyvec/naucse.python.cz/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pyvec/naucse.python.cz/teams","hooks_url":"https://api.github.com/repos/pyvec/naucse.python.cz/hooks","issue_events_url":"https://api.github.com/repos/pyvec/naucse.python.cz/issues/events{/number}","events_url":"https://api.github.com/repos/pyvec/naucse.python.cz/events","assignees_url":"https://api.github.com/repos/pyvec/naucse.python.cz/assignees{/user}","branches_url":"https://api.github.com/repos/pyvec/naucse.python.cz/branches{/branch}","tags_url":"https://api.github.com/repos/pyvec/naucse.python.cz/tags","blobs_url":"https://api.github.com/repos/pyvec/naucse.python.cz/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pyvec/naucse.python.cz/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pyvec/naucse.python.cz/git/refs{/sha}","trees_url":"https://api.github.com/repos/pyvec/naucse.python.cz/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pyvec/naucse.python.cz/statuses/{sha}","languages_url":"https://api.github.com/repos/pyvec/naucse.python.cz/languages","stargazers_url":"https://api.github.com/repos/pyvec/naucse.python.cz/stargazers","contributors_url":"https://api.github.com/repos/pyvec/naucse.python.cz/contributors","subscribers_url":"https://api.github.com/repos/pyvec/naucse.python.cz/subscribers","subscription_url":"https://api.github.com/repos/pyvec/naucse.python.cz/subscription","commits_url":"https://api.github.com/repos/pyvec/naucse.python.cz/commits{/sha}","git_commits_url":"https://api.github.com/repos/pyvec/naucse.python.cz/git/commits{/sha}","comments_url":"https://api.github.com/repos/pyvec/naucse.python.cz/comments{/number}","issue_comment_url":"https://api.github.com/repos/pyvec/naucse.python.cz/issues/comments{/number}","contents_url":"https://api.github.com/repos/pyvec/naucse.python.cz/contents/{+path}","compare_url":"https://api.github.com/repos/pyvec/naucse.python.cz/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pyvec/naucse.python.cz/merges","archive_url":"https://api.github.com/repos/pyvec/naucse.python.cz/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pyvec/naucse.python.cz/downloads","issues_url":"https://api.github.com/repos/pyvec/naucse.python.cz/issues{/number}","pulls_url":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls{/number}","milestones_url":"https://api.github.com/repos/pyvec/naucse.python.cz/milestones{/number}","notifications_url":"https://api.github.com/repos/pyvec/naucse.python.cz/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pyvec/naucse.python.cz/labels{/name}","releases_url":"https://api.github.com/repos/pyvec/naucse.python.cz/releases{/id}","deployments_url":"https://api.github.com/repos/pyvec/naucse.python.cz/deployments","created_at":"2016-08-20T11:58:09Z","updated_at":"2018-11-11T22:58:02Z","pushed_at":"2018-11-16T13:13:18Z","git_url":"git://github.com/pyvec/naucse.python.cz.git","ssh_url":"git@github.com:pyvec/naucse.python.cz.git","clone_url":"https://github.com/pyvec/naucse.python.cz.git","svn_url":"https://github.com/pyvec/naucse.python.cz","homepage":"https://naucse.python.cz","size":65396,"stargazers_count":110,"watchers_count":110,"language":"Jupyter Notebook","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":50,"mirror_url":null,"archived":false,"open_issues_count":107,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":50,"open_issues":107,"watchers":110,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/489"},"html":{"href":"https://github.com/pyvec/naucse.python.cz/pull/489"},"issue":{"href":"https://api.github.com/repos/pyvec/naucse.python.cz/issues/489"},"comments":{"href":"https://api.github.com/repos/pyvec/naucse.python.cz/issues/489/comments"},"review_comments":{"href":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/489/comments"},"review_comment":{"href":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/pyvec/naucse.python.cz/pulls/489/commits"},"statuses":{"href":"https://api.github.com/repos/pyvec/naucse.python.cz/statuses/090ba936605f8a583103998e4021d6ec9a54e148"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"encukou"}}