From 30557c0705d27c87912debcc690650fe3bc06ef8 Mon Sep 17 00:00:00 2001 From: Dannon Baker Date: Wed, 13 May 2015 12:57:23 -0400 Subject: [PATCH 1/3] Fix display regression from overzealous sanitzation in c8a71c7e8988d80bf406f11bfb9b8d3ed815e97e --- templates/webapps/galaxy/workflow/run.mako | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/templates/webapps/galaxy/workflow/run.mako b/templates/webapps/galaxy/workflow/run.mako index 8d780be2f94..abe9b86116c 100644 --- a/templates/webapps/galaxy/workflow/run.mako +++ b/templates/webapps/galaxy/workflow/run.mako @@ -583,9 +583,10 @@ if wf_parms: <% pja_ss_all = [] for pja_ss in [ActionBox.get_short_str(pja) for pja in step.post_job_actions]: - pja_ss = h.escape( pja_ss ) for rematch in re.findall('\$\{.+?\}', pja_ss): - pja_ss = pja_ss.replace(rematch, '%s' % (wf_parms[rematch[2:-1]], rematch[2:-1], rematch[2:-1])) + pja_ss = pja_ss.replace(rematch, '%s' % (h.escape(wf_parms[rematch[2:-1]]), + h.escape(rematch[2:-1]), + h.escape(rematch[2:-1]))) pja_ss_all.append(pja_ss) %> ${'
'.join(pja_ss_all)} From 0a7f50dbaa9c9c72d6fedbaee58697587f7301c7 Mon Sep 17 00:00:00 2001 From: Dannon Baker Date: Wed, 13 May 2015 15:45:01 -0400 Subject: [PATCH 2/3] Change sanitization of workflow pja's for display in workflow/run to happen in get_short_str, trusting that output. This is probably still overzealous, and we should check if there's a way to exploit tool.output_names (and if not, pull back on that sanitization). --- lib/galaxy/jobs/actions/post.py | 16 +++++++++++----- templates/webapps/galaxy/workflow/run.mako | 6 +++--- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/lib/galaxy/jobs/actions/post.py b/lib/galaxy/jobs/actions/post.py index eff28baf095..4985d91dd49 100644 --- a/lib/galaxy/jobs/actions/post.py +++ b/lib/galaxy/jobs/actions/post.py @@ -8,6 +8,9 @@ import logging import socket from galaxy.util import send_mail from galaxy.util.json import dumps +from galaxy import eggs +eggs.require( "MarkupSafe" ) +from markupsafe import escape log = logging.getLogger( __name__ ) @@ -50,7 +53,7 @@ class DefaultJobAction(object): @classmethod def get_short_str(cls, pja): if pja.action_arguments: - return "%s -> %s" % (pja.action_type, pja.action_arguments) + return "%s -> %s" % (pja.action_type, escape(pja.action_arguments)) else: return "%s" % pja.action_type @@ -91,7 +94,7 @@ class EmailAction(DefaultJobAction): @classmethod def get_short_str(cls, pja): if pja.action_arguments and 'host' in pja.action_arguments: - return "Email the current user from server %s when this job is complete." % pja.action_arguments['host'] + return "Email the current user from server %s when this job is complete." % escape(pja.action_arguments['host']) else: return "Email the current user when this job is complete." @@ -127,7 +130,8 @@ class ChangeDatatypeAction(DefaultJobAction): @classmethod def get_short_str(cls, pja): - return "Set the datatype of output '%s' to '%s'" % (pja.output_name, pja.action_arguments['newtype']) + return "Set the datatype of output '%s' to '%s'" % (escape(pja.output_name), + escape(pja.action_arguments['newtype'])) class RenameDatasetAction(DefaultJobAction): @@ -235,7 +239,8 @@ class RenameDatasetAction(DefaultJobAction): def get_short_str(cls, pja): # Prevent renaming a dataset to the empty string. if pja.action_arguments and pja.action_arguments.get('newname', ''): - return "Rename output '%s' to '%s'." % (pja.output_name, pja.action_arguments['newname']) + return "Rename output '%s' to '%s'." % (escape(pja.output_name), + escape(pja.action_arguments['newname'])) else: return "Rename action used without a new name specified. Output name will be unchanged." @@ -455,7 +460,8 @@ class TagDatasetAction(DefaultJobAction): @classmethod def get_short_str(cls, pja): if pja.action_arguments and pja.action_arguments.get('tags', ''): - return "Add tag(s) '%s' to '%s'." % (pja.action_arguments['tags'], pja.output_name) + return "Add tag(s) '%s' to '%s'." % (escape(pja.action_arguments['tags']), + escape(pja.output_name)) else: return "Tag addition action used without a tag specified. No tag will be added." diff --git a/templates/webapps/galaxy/workflow/run.mako b/templates/webapps/galaxy/workflow/run.mako index abe9b86116c..4e60faad487 100644 --- a/templates/webapps/galaxy/workflow/run.mako +++ b/templates/webapps/galaxy/workflow/run.mako @@ -584,9 +584,9 @@ if wf_parms: pja_ss_all = [] for pja_ss in [ActionBox.get_short_str(pja) for pja in step.post_job_actions]: for rematch in re.findall('\$\{.+?\}', pja_ss): - pja_ss = pja_ss.replace(rematch, '%s' % (h.escape(wf_parms[rematch[2:-1]]), - h.escape(rematch[2:-1]), - h.escape(rematch[2:-1]))) + pja_ss = pja_ss.replace(rematch, '%s' % (wf_parms[rematch[2:-1]], + rematch[2:-1], + rematch[2:-1])) pja_ss_all.append(pja_ss) %> ${'
'.join(pja_ss_all)} From cfea0386f4105df7ebbb20e0bdc51c09b7c7522e Mon Sep 17 00:00:00 2001 From: Dannon Baker Date: Wed, 13 May 2015 15:47:56 -0400 Subject: [PATCH 3/3] Missed one. --- lib/galaxy/jobs/actions/post.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/galaxy/jobs/actions/post.py b/lib/galaxy/jobs/actions/post.py index 4985d91dd49..da867d47aa6 100644 --- a/lib/galaxy/jobs/actions/post.py +++ b/lib/galaxy/jobs/actions/post.py @@ -265,7 +265,7 @@ class HideDatasetAction(DefaultJobAction): @classmethod def get_short_str(cls, pja): - return "Hide output '%s'." % pja.output_name + return "Hide output '%s'." % escape(pja.output_name) class DeleteDatasetAction(DefaultJobAction): @@ -341,7 +341,7 @@ class ColumnSetAction(DefaultJobAction): @classmethod def get_short_str(cls, pja): - return "Set the following metadata values:
" + "
".join(['%s : %s' % (k, v) for k, v in pja.action_arguments.iteritems()]) + return "Set the following metadata values:
" + "
".join(['%s : %s' % (escape(k), escape(v)) for k, v in pja.action_arguments.iteritems()]) class SetMetadataAction(DefaultJobAction):