From 69ff4677bc42eb25dc9979d32e670456ba4478e7 Mon Sep 17 00:00:00 2001 From: Dave Bouvier Date: Wed, 10 Dec 2014 11:31:21 -0500 Subject: [PATCH] Escape anything that could be user input in mako templates, add markupsafe.escape to username and email in users API controller. --- lib/galaxy/webapps/galaxy/api/users.py | 9 ++-- .../admin/dataset_security/group/group.mako | 14 +++---- .../dataset_security/group/group_create.mako | 6 +-- .../dataset_security/group/group_rename.mako | 2 +- .../admin/dataset_security/role/role.mako | 22 +++++----- .../dataset_security/role/role_create.mako | 8 ++-- .../dataset_security/role/role_rename.mako | 4 +- .../create_external_service.mako | 4 +- .../edit_external_service.mako | 4 +- templates/admin/jobs.mako | 18 ++++---- templates/admin/memdump.mako | 2 +- templates/admin/package_tool.mako | 6 +-- templates/admin/quota/quota.mako | 14 +++---- templates/admin/quota/quota_create.mako | 10 ++--- templates/admin/quota/quota_edit.mako | 2 +- templates/admin/quota/quota_rename.mako | 4 +- templates/admin/reload_tool.mako | 6 +-- .../admin/review_tool_migration_stages.mako | 22 +++++----- .../browse_repository.mako | 2 +- .../browse_tool_dependency.mako | 12 +++--- .../admin/tool_shed_repository/common.mako | 11 ++--- .../deactivate_or_uninstall_repository.mako | 14 +++---- .../initiate_repository_installation.mako | 6 +-- ...install_tool_dependencies_with_update.mako | 20 ++++----- .../manage_repository.mako | 20 ++++----- .../manage_repository_tool_dependencies.mako | 14 +++---- .../purge_repository_confirmation.mako | 14 +++---- .../repair_repository.mako | 4 +- .../repository_installation_status.mako | 3 +- .../reselect_tool_panel_section.mako | 4 +- .../select_shed_tool_panel_config.mako | 6 +-- .../select_tool_panel_section.mako | 6 +-- .../uninstall_tool_dependencies.mako | 8 ++-- .../view_tool_metadata.mako | 42 +++++++++---------- .../tool_shed_repository/view_workflow.mako | 2 +- templates/admin/user/reset_password.mako | 2 +- templates/admin/user/user.mako | 14 +++---- templates/admin/view_datatypes_registry.mako | 8 ++-- templates/base.mako | 2 +- templates/galaxy_client_app.mako | 3 +- templates/user/index.mako | 2 +- .../webapps/galaxy/admin/tool_sheds.mako | 2 +- templates/webapps/galaxy/dataset/errors.mako | 2 +- templates/webapps/galaxy/galaxy.masthead.mako | 3 +- templates/webapps/galaxy/galaxy.panels.mako | 2 +- templates/webapps/tool_shed/base_panels.mako | 5 ++- 46 files changed, 200 insertions(+), 190 deletions(-) diff --git a/lib/galaxy/webapps/galaxy/api/users.py b/lib/galaxy/webapps/galaxy/api/users.py index ef8bcdf206e..d04f4e75aa0 100644 --- a/lib/galaxy/webapps/galaxy/api/users.py +++ b/lib/galaxy/webapps/galaxy/api/users.py @@ -11,6 +11,7 @@ from galaxy.security.validate_user_input import validate_publicname from galaxy.web.base.controller import BaseAPIController, UsesTagsMixin from galaxy.web.base.controller import CreatesApiKeysMixin from galaxy.web.base.controller import CreatesUsersMixin +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -38,10 +39,10 @@ class UserAPIController( BaseAPIController, UsesTagsMixin, CreatesUsersMixin, Cr query = query.filter( trans.app.model.User.table.c.deleted == False ) # noqa # special case: user can see only their own user if not trans.user_is_admin(): - item = trans.user.to_dict( value_mapper={ 'id': trans.security.encode_id } ) + item = trans.user.to_dict( value_mapper={ 'id': trans.security.encode_id, 'email': escape } ) return [item] for user in query: - item = user.to_dict( value_mapper={ 'id': trans.security.encode_id } ) + item = user.to_dict( value_mapper={ 'id': trans.security.encode_id, 'email': escape } ) # TODO: move into api_values rval.append( item ) return rval @@ -78,7 +79,9 @@ class UserAPIController( BaseAPIController, UsesTagsMixin, CreatesUsersMixin, Cr else: raise HTTPBadRequest( detail='Invalid user id ( %s ) specified' % id ) item = user.to_dict( view='element', value_mapper={ 'id': trans.security.encode_id, - 'total_disk_usage': float } ) + 'total_disk_usage': float, + 'email': escape, + 'username': escape } ) # add a list of tags used by the user (as strings) item[ 'tags_used' ] = self.get_user_tags_used( trans, user=user ) # TODO: move into api_values (needs trans, tho - can we do that with api_keys/@property??) diff --git a/templates/admin/dataset_security/group/group.mako b/templates/admin/dataset_security/group/group.mako index 7c3400e4811..d8f013b007b 100644 --- a/templates/admin/dataset_security/group/group.mako +++ b/templates/admin/dataset_security/group/group.mako @@ -11,9 +11,9 @@ <%def name="render_select( name, options )"> - %for option in options: - + %endfor @@ -48,29 +48,29 @@ $().ready(function() { %endif
-
Group '${group.name}'
+
Group '${group.name|h}'
- + ${render_select( "in_roles", in_roles )}
- + ${render_select( "out_roles", out_roles )}
- + ${render_select( "in_users", in_users )}
- + ${render_select( "out_users", out_users )}
diff --git a/templates/admin/dataset_security/group/group_create.mako b/templates/admin/dataset_security/group/group_create.mako index 126c8a33fac..307611b90ef 100644 --- a/templates/admin/dataset_security/group/group_create.mako +++ b/templates/admin/dataset_security/group/group_create.mako @@ -11,9 +11,9 @@ <%def name="render_select( name, options )"> - %for option in options: - + %endfor @@ -60,7 +60,7 @@ $().ready(function() {
- +
diff --git a/templates/admin/dataset_security/group/group_rename.mako b/templates/admin/dataset_security/group/group_rename.mako index a4a051459b6..e434a671e8f 100644 --- a/templates/admin/dataset_security/group/group_rename.mako +++ b/templates/admin/dataset_security/group/group_rename.mako @@ -12,7 +12,7 @@
- +
diff --git a/templates/admin/dataset_security/role/role.mako b/templates/admin/dataset_security/role/role.mako index ccad5e165f9..c1e2cf0e0cb 100644 --- a/templates/admin/dataset_security/role/role.mako +++ b/templates/admin/dataset_security/role/role.mako @@ -11,9 +11,9 @@ <%def name="render_select( name, options )"> - %for option in options: - + %endfor @@ -48,29 +48,29 @@ $().ready(function() { %endif
-
Role '${role.name}'
+
Role '${role.name|h}'
- + ${render_select( "in_users", in_users )}
- + ${render_select( "out_users", out_users )}
- + ${render_select( "in_groups", in_groups )}
- + ${render_select( "out_groups", out_groups )}
@@ -84,7 +84,7 @@ $().ready(function() {

%if len( library_dataset_actions ) > 0: -

Data library datasets associated with role '${role.name}'

+

Data library datasets associated with role '${role.name|h}'

%if job.history and job.history.user: - + %else: %endif - + <% try: @@ -77,8 +77,8 @@ inputs = 'Unable to determine inputs' %> - - + + %endfor @@ -131,12 +131,12 @@ %for job in recent_jobs: %if job.history and job.history.user: - + %else: %endif - + <% try: @@ -145,9 +145,9 @@ inputs = 'Unable to determine inputs' %> - - - + + + %endfor
@@ -92,16 +92,16 @@ $().ready(function() { %for ctr, library, in enumerate( library_dataset_actions.keys() ):
  • - ${library.name} + ${library.name|h}
      %for folder_path, permissions in library_dataset_actions[ library ].items():
    • - ${folder_path} + ${folder_path|h}
        % for permission in permissions:
          -
        • ${permission}
          • +
        • ${permission|h}
        %endfor
      diff --git a/templates/admin/dataset_security/role/role_create.mako b/templates/admin/dataset_security/role/role_create.mako index 02f3d7a37ca..e0e67ee49be 100644 --- a/templates/admin/dataset_security/role/role_create.mako +++ b/templates/admin/dataset_security/role/role_create.mako @@ -11,9 +11,9 @@ <%def name="render_select( name, options )"> - %for option in options: - + %endfor @@ -60,11 +60,11 @@
      - +
      - +
      diff --git a/templates/admin/dataset_security/role/role_rename.mako b/templates/admin/dataset_security/role/role_rename.mako index 1795699868e..d8a7dae0a7f 100644 --- a/templates/admin/dataset_security/role/role_rename.mako +++ b/templates/admin/dataset_security/role/role_rename.mako @@ -12,14 +12,14 @@
      - +
      - +
      diff --git a/templates/admin/external_service/create_external_service.mako b/templates/admin/external_service/create_external_service.mako index 3762161733b..b39e480f0d0 100644 --- a/templates/admin/external_service/create_external_service.mako +++ b/templates/admin/external_service/create_external_service.mako @@ -12,10 +12,10 @@ %if widgets: %for i, field in enumerate( widgets ):
      - + ${field['widget'].get_html()}
      - ${field['helptext']} + ${field['helptext']|h}
      diff --git a/templates/admin/external_service/edit_external_service.mako b/templates/admin/external_service/edit_external_service.mako index 1d45bd219e5..5245e3aa081 100644 --- a/templates/admin/external_service/edit_external_service.mako +++ b/templates/admin/external_service/edit_external_service.mako @@ -25,10 +25,10 @@
      Edit external service
      %for i, field in enumerate( widgets ):
      - + ${field['widget'].get_html()}
      - ${field['helptext']} + ${field['helptext']|h}
      diff --git a/templates/admin/jobs.mako b/templates/admin/jobs.mako index 9cd694fdbee..e7dfe13f075 100644 --- a/templates/admin/jobs.mako +++ b/templates/admin/jobs.mako @@ -63,12 +63,12 @@
    		• ${job.id}${job.history.user.email}${job.history.user.email|h}anonymous${last_updated[job.id]} ago${job.tool_id}${job.tool_id|h} ${job.state}${inputs}${job.command_line}${job.job_runner_name}${job.command_line|h}${job.job_runner_name|h} ${job.job_runner_external_id}
    ${job.id}${job.history.user.email}${job.history.user.email|h}anonymous${finished[job.id]} ago${job.tool_id}${job.tool_id|h} ${job.state}${inputs}${job.command_line}${job.job_runner_name}${job.job_runner_external_id}${job.command_line|h}${job.job_runner_name|h}${job.job_runner_external_id|h}
    diff --git a/templates/admin/memdump.mako b/templates/admin/memdump.mako index d15c3577739..63a6da35ecf 100644 --- a/templates/admin/memdump.mako +++ b/templates/admin/memdump.mako @@ -55,7 +55,7 @@
    You are here: ${breadcrumb}
    %if breadcrumb.endswith( 'theone' ): - ${heap} + ${heap|h} %else: Sort: diff --git a/templates/admin/package_tool.mako b/templates/admin/package_tool.mako index 59bfb96f1a3..fef8ac765d5 100644 --- a/templates/admin/package_tool.mako +++ b/templates/admin/package_tool.mako @@ -28,9 +28,9 @@ $().ready(function() { + @@ -48,29 +48,29 @@ $().ready(function() { %endif
    -
    Quota '${name}'
    +
    Quota '${name|h}'
    - + ${render_select( "in_users", in_users )}
    - + ${render_select( "out_users", out_users )}
    - + ${render_select( "in_groups", in_groups )}
    - + ${render_select( "out_groups", out_groups )}
    diff --git a/templates/admin/quota/quota_create.mako b/templates/admin/quota/quota_create.mako index 77da81f894f..c581744cfbe 100644 --- a/templates/admin/quota/quota_create.mako +++ b/templates/admin/quota/quota_create.mako @@ -11,9 +11,9 @@ <%def name="render_select( name, options )"> - %for option in options: - + %endfor @@ -69,15 +69,15 @@
    - +
    - +
    - +
    Examples: "10000MB", "99 gb", "0.2T", "unlimited"
    diff --git a/templates/admin/quota/quota_edit.mako b/templates/admin/quota/quota_edit.mako index 7ed14713fbb..c437fea5e1c 100644 --- a/templates/admin/quota/quota_edit.mako +++ b/templates/admin/quota/quota_edit.mako @@ -29,7 +29,7 @@
    - +
    Examples: "10000MB", "99 gb", "0.2T", "unlimited"
    diff --git a/templates/admin/quota/quota_rename.mako b/templates/admin/quota/quota_rename.mako index 67c224b8cc2..476518b6209 100644 --- a/templates/admin/quota/quota_rename.mako +++ b/templates/admin/quota/quota_rename.mako @@ -21,14 +21,14 @@
    - +
    - +
    diff --git a/templates/admin/reload_tool.mako b/templates/admin/reload_tool.mako index 61b3e867624..df5dfd498c5 100644 --- a/templates/admin/reload_tool.mako +++ b/templates/admin/reload_tool.mako @@ -28,9 +28,9 @@ $().ready(function() { %endif - +
    diff --git a/templates/admin/tool_shed_repository/initiate_repository_installation.mako b/templates/admin/tool_shed_repository/initiate_repository_installation.mako index f8c3712757e..35743d5c00d 100644 --- a/templates/admin/tool_shed_repository/initiate_repository_installation.mako +++ b/templates/admin/tool_shed_repository/initiate_repository_installation.mako @@ -53,18 +53,18 @@ %if link_to_manage_tool_dependencies: - ${tool_shed_repository.name} + ${tool_shed_repository.name|h} %else: - ${tool_shed_repository.name} + ${tool_shed_repository.name|h} %endif ${tool_shed_repository.description} ${tool_shed_repository.owner} ${tool_shed_repository.changeset_revision} -
    ${tool_shed_repository.status}
    +
    ${tool_shed_repository.status|h}
    %endfor diff --git a/templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako b/templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako index 32d08ff1809..7c1955f8393 100644 --- a/templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako +++ b/templates/admin/tool_shed_repository/install_tool_dependencies_with_update.mako @@ -20,12 +20,12 @@ ${render_galaxy_repository_actions( repository )}
    - - - - - - + + + + + + %if tool_dependencies_dict: %if install_tool_dependencies_check_box is not None:
    @@ -71,12 +71,12 @@ ${render_galaxy_repository_actions( repository )} %> %if not os.path.exists( install_dir ): - ${key_name} - ${key_version} - ${install_dir} + ${key_name|h} + ${key_version|h} + ${install_dir|h} %if readme_text: - ${key_name} ${key_version} requirements and installation information + ${key_name|h} ${key_version|h} requirements and installation information 
    ${readme_text}
    %endif %endif diff --git a/templates/admin/tool_shed_repository/manage_repository.mako b/templates/admin/tool_shed_repository/manage_repository.mako index 1c7c59d7e5f..d474fc2727a 100644 --- a/templates/admin/tool_shed_repository/manage_repository.mako +++ b/templates/admin/tool_shed_repository/manage_repository.mako @@ -22,50 +22,50 @@ ${render_galaxy_repository_actions( repository )} %endif
    -
    Installed tool shed repository '${repository.name}'
    +
    Installed tool shed repository '${repository.name|h}'
    - ${repository.tool_shed} + ${repository.tool_shed|h}
    - ${repository.name} + ${repository.name|h}
    %if in_error_state: - ${description} + ${description|h} %else: - + %endif
    - ${repository.changeset_revision} + ${repository.changeset_revision|h}
    - ${repository.owner} + ${repository.owner|h}
    %if in_error_state:
    - ${repository.error_message} + ${repository.error_message|h}
    %else:
    - ${repo_files_dir} + ${repo_files_dir|h}
    %endif
    - ${repository.deleted} + ${repository.deleted|h}
    %if not in_error_state:
    diff --git a/templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako b/templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako index 0a5271495bd..0a37b6fe65c 100644 --- a/templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako +++ b/templates/admin/tool_shed_repository/manage_repository_tool_dependencies.mako @@ -20,7 +20,7 @@ ${render_galaxy_repository_actions( repository )} %endif
    -
    Tool shed repository '${repository.name}' tool dependencies
    +
    Tool shed repository '${repository.name|h}' tool dependencies
    <% can_install = False can_uninstall = False @@ -48,16 +48,16 @@ ${render_galaxy_repository_actions( repository )} %if tool_dependency.status not in [ trans.install_model.ToolDependency.installation_status.UNINSTALLED ]: - ${tool_dependency.name} + ${tool_dependency.name|h} %else: - ${tool_dependency.name} + ${tool_dependency.name|h} %endif - ${tool_dependency.version} - ${tool_dependency.type} - ${tool_dependency.status} - ${error_message} + ${tool_dependency.version|h} + ${tool_dependency.type|h} + ${tool_dependency.status|h} + ${error_message|h} %endfor diff --git a/templates/admin/tool_shed_repository/purge_repository_confirmation.mako b/templates/admin/tool_shed_repository/purge_repository_confirmation.mako index eda8431ef26..fd53127a233 100644 --- a/templates/admin/tool_shed_repository/purge_repository_confirmation.mako +++ b/templates/admin/tool_shed_repository/purge_repository_confirmation.mako @@ -19,14 +19,14 @@ ${render_galaxy_repository_actions( repository )}

    - Purging the repository named ${repository.name} will result in deletion of all records for the + Purging the repository named ${repository.name|h} will result in deletion of all records for the following associated items from the database. Click the Purge button to purge this repository and its associated items.

    -
    Purge tool shed repository ${repository.name}
    +
    Purge tool shed repository ${repository.name|h}
    <% tool_versions = 0 @@ -59,11 +59,11 @@ ${render_galaxy_repository_actions( repository )} orphan_repository_dependency_records += 1 %> - - - - - + + + + +
    Tool version records${tool_versions}
    Tool dependency records${tool_dependencies}
    Repository dependency records${required_repositories}
    Orphan repository_repository_dependency_association records${orphan_repository_repository_dependency_association_records}
    Orphan repository_dependency records${orphan_repository_dependency_records}
    Tool version records${tool_versions|h}
    Tool dependency records${tool_dependencies|h}
    Repository dependency records${required_repositories|h}
    Orphan repository_repository_dependency_association records${orphan_repository_repository_dependency_association_records|h}
    Orphan repository_dependency records${orphan_repository_dependency_records|h}
    diff --git a/templates/admin/tool_shed_repository/repair_repository.mako b/templates/admin/tool_shed_repository/repair_repository.mako index f31f91c03a9..8f1d643f983 100644 --- a/templates/admin/tool_shed_repository/repair_repository.mako +++ b/templates/admin/tool_shed_repository/repair_repository.mako @@ -37,9 +37,9 @@ ${render_galaxy_repository_actions( repository )}
    -
    Repair tool shed repository ${repository.name}
    +
    Repair tool shed repository ${repository.name|h}
    - + <% from tool_shed.util.shed_util_common import get_tool_shed_repository_status_label ordered_repo_info_dicts = repair_dict.get( 'ordered_repo_info_dicts', [] ) diff --git a/templates/admin/tool_shed_repository/repository_installation_status.mako b/templates/admin/tool_shed_repository/repository_installation_status.mako index 7e41b367c79..fccc8d69bee 100644 --- a/templates/admin/tool_shed_repository/repository_installation_status.mako +++ b/templates/admin/tool_shed_repository/repository_installation_status.mako @@ -1,5 +1,6 @@ <%def name="render_repository_status( repository )"> <% + from markupsafe import escape if repository.status in [ trans.install_model.ToolShedRepository.installation_status.CLONING, trans.install_model.ToolShedRepository.installation_status.SETTING_TOOL_VERSIONS, trans.install_model.ToolShedRepository.installation_status.INSTALLING_TOOL_DEPENDENCIES, @@ -20,7 +21,7 @@ else: bgcolor = trans.install_model.ToolShedRepository.states.ERROR rval = '
    ' % ( bgcolor, trans.security.encode_id( repository.id ) ) - rval += '%s
    ' % repository.status + rval += '%s
    ' % escape( repository.status ) return rval %> ${rval} diff --git a/templates/admin/tool_shed_repository/reselect_tool_panel_section.mako b/templates/admin/tool_shed_repository/reselect_tool_panel_section.mako index 36a578c0cd5..d39fbb77ed1 100644 --- a/templates/admin/tool_shed_repository/reselect_tool_panel_section.mako +++ b/templates/admin/tool_shed_repository/reselect_tool_panel_section.mako @@ -62,12 +62,12 @@ ${shed_tool_conf_select_field.get_html()}
    - ${select_help} + ${select_help|h}
    %else: - + %endif %if includes_tools_for_display_in_tool_panel:
    diff --git a/templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako b/templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako index 02b18b8c0de..8931a6b0cf4 100644 --- a/templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako +++ b/templates/admin/tool_shed_repository/select_shed_tool_panel_config.mako @@ -71,7 +71,7 @@ - +
    <% readme_files_dict = containers_dict.get( 'readme_files', None ) %> @@ -111,12 +111,12 @@ ${shed_tool_conf_select_field.get_html()}
    - ${select_help} + ${select_help|h}
    %else: - + %endif
    diff --git a/templates/admin/tool_shed_repository/select_tool_panel_section.mako b/templates/admin/tool_shed_repository/select_tool_panel_section.mako index 22693477545..7b3ec0973fa 100644 --- a/templates/admin/tool_shed_repository/select_tool_panel_section.mako +++ b/templates/admin/tool_shed_repository/select_tool_panel_section.mako @@ -111,16 +111,16 @@ ${shed_tool_conf_select_field.get_html()}
    - ${select_help} + ${select_help|h}
    %else: - + %endif
    - +
    Add a new tool panel section to contain the installed tools (optional).
    diff --git a/templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako b/templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako index a579c2c5006..3311b7fee27 100644 --- a/templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako +++ b/templates/admin/tool_shed_repository/uninstall_tool_dependencies.mako @@ -43,10 +43,10 @@ ${render_galaxy_repository_actions( repository )} install_dir = "This dependency's installation directory does not exist, click Uninstall to reset for installation." %> - ${tool_dependency.name} - ${tool_dependency.version} - ${tool_dependency.type} - ${install_dir} + ${tool_dependency.name|h} + ${tool_dependency.version|h} + ${tool_dependency.type|h} + ${install_dir|h} %endfor diff --git a/templates/admin/tool_shed_repository/view_tool_metadata.mako b/templates/admin/tool_shed_repository/view_tool_metadata.mako index 5264e491eef..8849b367ed0 100644 --- a/templates/admin/tool_shed_repository/view_tool_metadata.mako +++ b/templates/admin/tool_shed_repository/view_tool_metadata.mako @@ -11,7 +11,7 @@ ${render_galaxy_repository_actions( repository )} %if tool_metadata:

    -
    ${tool_metadata[ 'name' ]} tool metadata
    +
    ${tool_metadata[ 'name' ]|h} tool metadata
    @@ -20,41 +20,41 @@ ${render_galaxy_repository_actions( repository )}
    - ${tool_metadata[ 'name' ]} + ${tool_metadata[ 'name' ]|h}
    %if 'description' in tool_metadata:
    - ${tool_metadata[ 'description' ]} + ${tool_metadata[ 'description' ]|h}
    %endif %if 'id' in tool_metadata:
    - ${tool_metadata[ 'id' ]} + ${tool_metadata[ 'id' ]|h}
    %endif %if 'guid' in tool_metadata:
    - ${tool_metadata[ 'guid' ]} + ${tool_metadata[ 'guid' ]|h}
    %endif %if 'version' in tool_metadata:
    - ${tool_metadata[ 'version' ]} + ${tool_metadata[ 'version' ]|h}
    %endif %if 'version_string_cmd' in tool_metadata:
    - ${tool_metadata[ 'version_string_cmd' ]} + ${tool_metadata[ 'version_string_cmd' ]|h}
    %endif @@ -70,9 +70,9 @@ ${render_galaxy_repository_actions( repository )} @@ -109,9 +109,9 @@ ${render_galaxy_repository_actions( repository )} requirement_type = requirement_dict[ 'type' ] or 'not provided' %> - - - + + + %endfor
    %if guid == tool_metadata[ 'guid' ]: - ${guid} (this tool) + ${guid|h} (this tool) %else: - ${guid} + ${guid|h} %endif
    ${requirement_name}${requirement_version}${requirement_type}${requirement_name|h}${requirement_version|h}${requirement_type|h}
    @@ -130,27 +130,27 @@ ${render_galaxy_repository_actions( repository )}
    - 
    ${tool.command}
    + 
    ${tool.command|h}
    - ${tool.interpreter} + ${tool.interpreter|h}
    - ${tool.is_multi_byte} + ${tool.is_multi_byte|h}
    - ${tool.force_history_refresh} + ${tool.force_history_refresh|h}
    - ${tool.parallelism} + ${tool.parallelism|h}
    %endif @@ -181,20 +181,20 @@ ${render_galaxy_repository_actions( repository )} required_files = test_dict[ 'required_files' ] %> - ${test_dict[ 'name' ]} + ${test_dict[ 'name' ]|h} %for input in inputs: - ${input[0]}: ${input[1]}
    + ${input[0]|h}: ${input[1]|h}
    %endfor %for output in outputs: - ${output[0]}: ${output[1]}
    + ${output[0]|h}: ${output[1]|h}
    %endfor %for required_file in required_files: - ${required_file}
    + ${required_file|h}
    %endfor diff --git a/templates/admin/tool_shed_repository/view_workflow.mako b/templates/admin/tool_shed_repository/view_workflow.mako index 26c2b925058..4d1bde5a861 100644 --- a/templates/admin/tool_shed_repository/view_workflow.mako +++ b/templates/admin/tool_shed_repository/view_workflow.mako @@ -17,7 +17,7 @@ <%def name="render_workflow( workflow_name, repository_id )"> <% center_url = h.url_for( controller='admin_toolshed', action='generate_workflow_image', workflow_name=tool_shed_encode( workflow_name ), repository_id=repository_id ) %> - + ${render_galaxy_repository_actions( repository )} diff --git a/templates/admin/user/reset_password.mako b/templates/admin/user/reset_password.mako index eb7f034e99d..0ac54d9ee06 100644 --- a/templates/admin/user/reset_password.mako +++ b/templates/admin/user/reset_password.mako @@ -13,7 +13,7 @@ %for user in users:
    - ${user.email} + ${user.email|h}
    %endfor diff --git a/templates/admin/user/user.mako b/templates/admin/user/user.mako index dfb28f29afa..41e77938183 100644 --- a/templates/admin/user/user.mako +++ b/templates/admin/user/user.mako @@ -11,9 +11,9 @@ <%def name="render_select( name, options )"> - %for option in options: - + %endfor @@ -48,29 +48,29 @@ $().ready(function() { %endif
    -
    User '${user.email}'
    +
    User '${user.email|h}'
    - + ${render_select( "in_roles", in_roles )}
    - + ${render_select( "out_roles", out_roles )}
    - + ${render_select( "in_groups", in_groups )}
    - + ${render_select( "out_groups", out_groups )}
    diff --git a/templates/admin/view_datatypes_registry.mako b/templates/admin/view_datatypes_registry.mako index 8332ee890aa..a83e545b1d1 100644 --- a/templates/admin/view_datatypes_registry.mako +++ b/templates/admin/view_datatypes_registry.mako @@ -37,16 +37,16 @@ %else: %endif - ${datatype.extension} - ${datatype.dtype} + ${datatype.extension|h} + ${datatype.dtype|h} %if datatype.mimetype: - ${datatype.mimetype} + ${datatype.mimetype|h} %endif %if datatype.display_in_upload: - ${datatype.display_in_upload} + ${datatype.display_in_upload|h} %endif diff --git a/templates/base.mako b/templates/base.mako index 5573f26d8b8..765b0f7b143 100644 --- a/templates/base.mako +++ b/templates/base.mako @@ -39,7 +39,7 @@ %endif diff --git a/templates/galaxy_client_app.mako b/templates/galaxy_client_app.mako index 51cdab38598..c259b78be6f 100644 --- a/templates/galaxy_client_app.mako +++ b/templates/galaxy_client_app.mako @@ -70,11 +70,12 @@ ${ h.dumps( get_config_dict() )} ## Return a dictionary of user or anonymous user data including: ## email, id, disk space used, quota percent, and tags used <% + from markupsafe import escape user_dict = {} try: if trans.user: user_dict = trans.user.to_dict( view='element', - value_mapper={ 'id': trans.security.encode_id, 'total_disk_usage': float } ) + value_mapper={ 'id': trans.security.encode_id, 'total_disk_usage': float, 'email': escape, 'username': escape } ) user_dict[ 'quota_percent' ] = trans.app.quota_agent.get_percent( trans=trans ) user_dict[ 'is_admin' ] = trans.user_is_admin() diff --git a/templates/user/index.mako b/templates/user/index.mako index df27c61499b..019ad82adc1 100644 --- a/templates/user/index.mako +++ b/templates/user/index.mako @@ -2,7 +2,7 @@ %if trans.user:

    ${_('User preferences')}

    -

    You are currently logged in as ${trans.user.email}.

    +

    You are currently logged in as ${trans.user.email|h}.

      %if t.webapp.name == 'galaxy': %if not trans.app.config.use_remote_user: diff --git a/templates/webapps/galaxy/admin/tool_sheds.mako b/templates/webapps/galaxy/admin/tool_sheds.mako index 1f8143d15c6..54fe80bc347 100644 --- a/templates/webapps/galaxy/admin/tool_sheds.mako +++ b/templates/webapps/galaxy/admin/tool_sheds.mako @@ -22,7 +22,7 @@
      Browse valid repositories diff --git a/templates/webapps/galaxy/dataset/errors.mako b/templates/webapps/galaxy/dataset/errors.mako index 194e2c2a7ce..11836bd1a24 100644 --- a/templates/webapps/galaxy/dataset/errors.mako +++ b/templates/webapps/galaxy/dataset/errors.mako @@ -95,7 +95,7 @@
      - +
      diff --git a/templates/webapps/galaxy/galaxy.masthead.mako b/templates/webapps/galaxy/galaxy.masthead.mako index 690efa90e09..f5061dfa9b4 100644 --- a/templates/webapps/galaxy/galaxy.masthead.mako +++ b/templates/webapps/galaxy/galaxy.masthead.mako @@ -3,6 +3,7 @@ ## masthead head generator <%def name="load(active_view = None)"> <% + from markupsafe import escape ## get configuration masthead_config = { ## inject configuration @@ -32,7 +33,7 @@ ## user details 'user' : { 'requests' : bool(trans.user and (trans.user.requests or trans.app.security_agent.get_accessible_request_types(trans, trans.user))), - 'email' : trans.user.email if (trans.user) else "", + 'email' : escape( trans.user.email ) if (trans.user) else "", 'valid' : bool(trans.user != None), 'json' : get_user_dict() } diff --git a/templates/webapps/galaxy/galaxy.panels.mako b/templates/webapps/galaxy/galaxy.panels.mako index 4ce7bbb1091..c62527026fe 100644 --- a/templates/webapps/galaxy/galaxy.panels.mako +++ b/templates/webapps/galaxy/galaxy.panels.mako @@ -49,7 +49,7 @@ %endif diff --git a/templates/webapps/tool_shed/base_panels.mako b/templates/webapps/tool_shed/base_panels.mako index 60c643af483..8feb6b66c5d 100644 --- a/templates/webapps/tool_shed/base_panels.mako +++ b/templates/webapps/tool_shed/base_panels.mako @@ -91,7 +91,8 @@ %> ## User tabs. - <% + <% + from markupsafe import escape # Menu for user who is not logged in. menu_options = [ [ _("Login"), h.url_for( controller='/user', action='login' ), "galaxy_main" ] ] if app.config.allow_user_creation: @@ -101,7 +102,7 @@ tab( "user", _("User"), None, visible=visible, menu_options=menu_options ) # Menu for user who is logged in. if trans.user: - email = trans.user.email + email = escape( trans.user.email ) else: email = "" menu_options = [ [ 'Logged in as %s' % email ] ]