opensource/galaxy
3
0
Fork 0
mirror of https://github.com/galaxyproject/galaxy.git synced 2026-09-24 16:30:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #15536 from martenson/wf-ids-exp

Browse Source 
[23.0] prevent leaking decoded ids through markdown error handling
This commit is contained in:
Marius van den Beek
2023-02-09 11:17:01 +01:00
committed by GitHub
parent b447729702 a396147789
commit 31d8c5fbb2
1 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/galaxy/managers/markdown_util.py
+12 -7
View File
@@ -110,13 +110,7 @@ class GalaxyInternalMarkdownDirectiveHandler(metaclass=abc.ABCMeta):
raise MalformedContents(f"Missing object identifier [{line}].")
def _remap(container, line):
id_match = re.search(UNENCODED_ID_PATTERN, line)
object_id = None
encoded_id = None
if id_match:
object_id = int(id_match.group(2))
encoded_id = trans.security.encode_id(object_id)
line = line.replace(id_match.group(), f"{id_match.group(1)}={encoded_id}")
line, object_id, encoded_id = self._encode_line(trans, line)
if container == "history_link":
_check_object(object_id, line)
history = history_manager.get_accessible(object_id, trans.user)
@@ -196,11 +190,22 @@ class GalaxyInternalMarkdownDirectiveHandler(metaclass=abc.ABCMeta):
try:
return _remap(container, line)
except Exception as e:
line, *_ = self._encode_line(trans, line)
return self.handle_error(container, line, str(e))
export_markdown = _remap_galaxy_markdown_calls(_remap_container, internal_galaxy_markdown)
return export_markdown
def _encode_line(self, trans, line):
id_match = re.search(UNENCODED_ID_PATTERN, line)
object_id = None
encoded_id = None
if id_match:
object_id = int(id_match.group(2))
encoded_id = trans.security.encode_id(object_id)
line = line.replace(id_match.group(), f"{id_match.group(1)}={encoded_id}")
return line, object_id, encoded_id
@abc.abstractmethod
def handle_history_link(self, line, history):
pass