Products.PortalTransforms/midsummersprint_fix_transforms: dont filter nasty_tags which are also in valid_tags

Repository: Products.PortalTransforms
Branch: refs/heads/midsummersprint_fix_transforms
Date: 2017-07-13T22:50:15+02:00
Author: MrTango (MrTango) <md-r4/[email protected]>
Commit: https://github.com/plone/Products.PortalTransforms/commit/18ecf053a1a7b63cde588142a8ca46ee58430325

dont filter nasty_tags which are also in valid_tags

Files changed:
M Products/PortalTransforms/tests/test_transforms.py
M Products/PortalTransforms/transforms/safe_html.py

diff --git a/Products/PortalTransforms/tests/test_transforms.py b/Products/PortalTransforms/tests/test_transforms.py
index c5114fe..0b79fd7 100644
--- a/Products/PortalTransforms/tests/test_transforms.py
+++ b/Products/PortalTransforms/tests/test_transforms.py
@@ -201,6 +201,18 @@ def setUp(self):
         registry = getUtility(IRegistry)
         self.settings = registry.forInterface(
             IFilterSchema, prefix="plone")
+        self.settings.valid_tags.append('style')
+
+    def tearDown(self):
+        self.settings.valid_tags.remove('style')
+
+    def test_kill_nasty_tags_which_are_not_valid(self):
+        self.assertTrue('script' in self.settings.nasty_tags)
+        self.assertFalse('script' in self.settings.valid_tags)
+        orig = '<script>foo</script>'
+        data_out = ''
+        data = self.pt.convertTo(target_mimetype='text/x-html-safe', orig=orig)
+        self.assertEqual(data.getData(), data_out)
 
     def test_entityiref_attributes(self):
         orig = '<a href="&uuml;">foo</a>'
@@ -233,12 +245,12 @@ class SafeHtmlTransformsWithScriptTest(unittest.TestCase):
     def setUp(self):
         self.portal = self.layer['portal']
         self.request = self.layer['request']
-        self.pt = self.portal.portal_transforms
         registry = getUtility(IRegistry)
         self.settings = registry.forInterface(
             IFilterSchema, prefix="plone")
         self.settings.valid_tags.append('script')
         self.settings.nasty_tags.remove('script')
+        self.pt = self.portal.portal_transforms
 
     def tearDown(self):
         self.settings.nasty_tags.append('script')
diff --git a/Products/PortalTransforms/transforms/safe_html.py b/Products/PortalTransforms/transforms/safe_html.py
index 9d6dea7..bc1a122 100644
--- a/Products/PortalTransforms/transforms/safe_html.py
+++ b/Products/PortalTransforms/transforms/safe_html.py
@@ -2424,7 +2424,8 @@ def strip_outer(s):
             IFilterSchema, prefix="plone")
 
         valid_tags = self.settings.valid_tags
-        nasty_tags = self.settings.nasty_tags
+        nasty_tags = [
+            tag for tag in self.settings.nasty_tags if tag not in valid_tags]
         safe_attrs = [attr.decode() for attr in html.defs.safe_attrs]
         safe_attrs.extend(
             self.settings.custom_attributes)



------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot