Merge pull request #11958 from cpennington/cale/xss

Make (some) Mako templates HTML escaped by default

cms/djangoapps/contentstore/views/course.py

@@ -563,11 +563,8 @@ def _deprecated_blocks_info(course_module, deprecated_block_types):
     except errors.CourseStructureNotAvailableError:
         return data
 
-    blocks = []
     for block in structure_data['blocks'].values():
-        blocks.append([reverse_usage_url('container_handler', block['parent']), block['display_name']])
-
-    data['blocks'].extend(blocks)
+        data['blocks'].append([reverse_usage_url('container_handler', block['parent']), block['display_name']])
 
     return data
 

cms/templates/activation_active.html

+<%page expression_filter="h"/>
 <%! from django.utils.translation import ugettext as _ %>
 <%inherit file="base.html" />
 

cms/templates/asset_index.html

+<%page expression_filter="h"/>
 <%inherit file="base.html" />
 <%def name="online_help_token()"><% return "files" %></%def>
 <%!
   from django.core.urlresolvers import reverse
   from django.utils.translation import ugettext as _
+  from openedx.core.djangolib.markup import Text, HTML
+  from openedx.core.djangolib.js_utils import js_escaped_string, dump_js_escaped_json
 %>
-<%block name="title">${_("Files &amp; Uploads")}</%block>
+<%block name="title">${_("Files & Uploads")}</%block>
 <%block name="bodyclass">is-signedin course uploads view-uploads</%block>
 
 <%namespace name='static' file='static_content.html'/>
@@ -20,10 +23,10 @@
 <%block name="requirejs">
     require(["js/factories/asset_index"], function (AssetIndexFactory) {
         AssetIndexFactory({
-          assetCallbackUrl: "${asset_callback_url}",
-          uploadChunkSizeInMBs: ${chunk_size_in_mbs},
-          maxFileSizeInMBs: ${max_file_size_in_mbs},
-          maxFileSizeRedirectUrl: "${max_file_size_redirect_url}"
+          assetCallbackUrl: "${asset_callback_url|n, js_escaped_string}",
+          uploadChunkSizeInMBs: ${chunk_size_in_mbs|n, dump_js_escaped_json},
+          maxFileSizeInMBs: ${max_file_size_in_mbs|n, dump_js_escaped_json},
+          maxFileSizeRedirectUrl: "${max_file_size_redirect_url|n, js_escaped_string}"
         });
     });
 </%block>
@@ -34,7 +37,7 @@
     <header class="mast has-actions has-subtitle">
         <h1 class="page-header">
             <small class="subtitle">${_("Content")}</small>
-            <span class="sr">&gt; </span>${_("Files &amp; Uploads")}
+            <span class="sr">&gt; </span>${_("Files & Uploads")}
         </h1>
 
         <nav class="nav-actions" aria-label="${_('Page Actions')}">
@@ -61,18 +64,18 @@
             <div class="bit">
                 <h3 class="title-3">${_("Adding Files for Your Course")}</h3>
 
-                <p>${_("To add files to use in your course, click {em_start}Upload New File{em_end}. Then follow the prompts to upload a file from your computer.").format(em_start='<strong>', em_end="</strong>")}</p>
+                <p>${Text(_("To add files to use in your course, click {em_start}Upload New File{em_end}. Then follow the prompts to upload a file from your computer.")).format(em_start=HTML("<strong>"), em_end=HTML("</strong>"))}</p>
 
-                <p>${_("{em_start}Caution{em_end}: {platform_name} recommends that you limit the file size to {em_start}10 MB{em_end}. In addition, do not upload video or audio files. You should use a third party service to host multimedia files.").format(em_start='<strong>', em_end="</strong>", platform_name=settings.PLATFORM_NAME)}</p>
+                <p>${Text(_("{em_start}Caution{em_end}: {platform_name} recommends that you limit the file size to {em_start}10 MB{em_end}. In addition, do not upload video or audio files. You should use a third party service to host multimedia files.")).format(em_start=HTML("<strong>"), em_end=HTML("</strong>"), platform_name=settings.PLATFORM_NAME)}</p>
 
             	<p>${_("The course image, textbook chapters, and files that appear on your Course Handouts sidebar also appear in this list.")}</p>
             </div>
             <div class="bit">
                 <h3 class="title-3">${_("Using File URLs")}</h3>
 
-                <p>${_("Use the {em_start}{studio_name} URL{em_end} value to link to the file or image from a component, a course update, or a course handout.").format(studio_name=settings.STUDIO_SHORT_NAME, em_start="<strong>", em_end="</strong>")}</p>
+                <p>${Text(_("Use the {em_start}{studio_name} URL{em_end} value to link to the file or image from a component, a course update, or a course handout.")).format(studio_name=settings.STUDIO_SHORT_NAME, em_start=HTML("<strong>"), em_end=HTML("</strong>"))}</p>
 
-                <p>${_("Use the {em_start}Web URL{em_end} value to reference the file or image only from outside of your course. {em_start}Note:{em_end} If you lock a file, the Web URL no longer works for external access to a file.").format(em_start='<strong>', em_end="</strong>")}</p>
+                <p>${Text(_("Use the {em_start}Web URL{em_end} value to reference the file or image only from outside of your course. {em_start}Note:{em_end} If you lock a file, the Web URL no longer works for external access to a file.")).format(em_start=HTML("<strong>"), em_end=HTML("</strong>"))}</p>
 
                 <p>${_("To copy a URL, double click the value in the URL column, then copy the selected text.")}</p>
             </div>

cms/templates/component.html

+<%page expression_filter="h"/>
 <%! from django.utils.translation import ugettext as _ %>
 <%namespace name='static' file='static_content.html'/>
 
@@ -27,4 +28,4 @@
     </ul>
 </div>
 <span data-tooltip="${_("Drag to reorder")}" class="drag-handle action"></span>
-${preview}
+${preview | n}

cms/templates/course-create-rerun.html

+<%page expression_filter="h"/>
 <%inherit file="base.html" />
 <%def name="online_help_token()"><% return "course_rerun" %></%def>
 <%!
 from django.utils.translation import ugettext as _
 from django.core.urlresolvers import reverse
-from django.template.defaultfilters import escapejs
+from openedx.core.djangolib.js_utils import js_escaped_string
 %>
 
 <%block name="title">${_("Create a Course Rerun of:")}</%block>
@@ -11,7 +12,7 @@ from django.template.defaultfilters import escapejs
 
 <%block name="jsextra">
   <script type="text/javascript">
-    var source_course_key = "${source_course_key | escapejs}";
+    var source_course_key = "${source_course_key | n, js_escaped_string}";
   </script>
 </%block>
 <%block name="requirejs">
@@ -39,8 +40,8 @@ from django.template.defaultfilters import escapejs
 
       <h2 class="page-header-super course-original">
         <span class="sr">${_("You are creating a re-run from:")}</span>
-        <span class="course-original-title-id">${source_course_key.org | h} ${source_course_key.course | h} ${source_course_key.run | h}</span>
-        <span class="course-original-title">${display_name | h}</span>
+        <span class="course-original-title-id">${source_course_key.org} ${source_course_key.course} ${source_course_key.run}</span>
+        <span class="course-original-title">${display_name}</span>
       </h2>
     </header>
   </div>
@@ -73,7 +74,7 @@ from django.template.defaultfilters import escapejs
                   <ol class="list-input">
                     <li class="field text required" id="field-course-name">
                       <label for="rerun-course-name">${_("Course Name")}</label>
-                      <input class="rerun-course-name" id="rerun-course-name" type="text" name="rerun-course-name" aria-required="true" value="${display_name | h}" placeholder="${_('e.g. Introduction to Computer Science')}" />
+                      <input class="rerun-course-name" id="rerun-course-name" type="text" name="rerun-course-name" aria-required="true" value="${display_name}" placeholder="${_('e.g. Introduction to Computer Science')}" />
                       <span class="tip">
                         ${_("The public display name for the new course. (This name is often the same as the original course name.)")}
                       </span>
@@ -81,7 +82,7 @@ from django.template.defaultfilters import escapejs
                     </li>
                     <li class="field text required" id="field-organization">
                       <label for="rerun-course-org">${_("Organization")}</label>
-                      <input class="rerun-course-org" id="rerun-course-org" type="text" name="rerun-course-org" aria-required="true" value="${source_course_key.org | h}" placeholder="${_('e.g. UniversityX or OrganizationX')}" />
+                      <input class="rerun-course-org" id="rerun-course-org" type="text" name="rerun-course-org" aria-required="true" value="${source_course_key.org}" placeholder="${_('e.g. UniversityX or OrganizationX')}" />
                       <span class="tip">
                         ${_("The name of the organization sponsoring the new course. (This name is often the same as the original organization name.)")}
                         <strong class="tip-note" class="tip-note">${_("Note: No spaces or special characters are allowed.")}</strong>
@@ -92,7 +93,7 @@ from django.template.defaultfilters import escapejs
                     <li class="row">
                       <div class="column field text required" id="field-course-number">
                         <label for="rerun-course-number">${_("Course Number")}</label>
-                        <input class="rerun-course-number" id="rerun-course-number" type="text" name="rerun-course-number" aria-required="true" value="${source_course_key.course | h}" placeholder="${_('e.g. CS101')}" />
+                        <input class="rerun-course-number" id="rerun-course-number" type="text" name="rerun-course-number" aria-required="true" value="${source_course_key.course}" placeholder="${_('e.g. CS101')}" />
                         <span class="tip">
                           ${_("The unique number that identifies the new course within the organization.  (This number is often the same as the original course number.)")}
                           <strong class="tip-note" class="tip-note">${_("Note: No spaces or special characters are allowed.")}</strong>
@@ -102,7 +103,7 @@ from django.template.defaultfilters import escapejs
 
                       <div class="column field text required" id="field-course-run">
                         <label for="rerun-course-run">${_("Course Run")}</label>
-                        <input class="rerun-course-run" id="rerun-course-run" type="text" name="rerun-course-run" aria-required="true"placeholder="${_('e.g. 2014_T1')}" />
+                        <input class="rerun-course-run" id="rerun-course-run" type="text" name="rerun-course-run" aria-required="true" placeholder="${_('e.g. 2014_T1')}" />
                         <span class="tip">
                           ${_("The term in which the new course will run. (This value is often different than the original course run value.)")}
                           <strong class="tip-note" class="tip-note">${_("Note: No spaces or special characters are allowed.")}</strong>

cms/templates/course_info.html

+<%page expression_filter="h"/>
 <%inherit file="base.html" />
 <%def name="online_help_token()"><% return "updates" %></%def>
 <%namespace name='static' file='static_content.html'/>

cms/templates/course_outline.html

+<%page expression_filter="h"/>
 <%inherit file="base.html" />
 <%def name="online_help_token()"><% return "outline" %></%def>
 <%!
@@ -7,6 +8,7 @@ from django.utils.translation import ugettext as _
 from openedx.core.djangolib.js_utils import dump_js_escaped_json
 from contentstore.utils import reverse_usage_url
 from openedx.core.djangoapps.self_paced.models import SelfPacedConfiguration
+from openedx.core.djangolib.markup import Text, HTML
 %>
 <%block name="title">${_("Course Outline")}</%block>
 <%block name="bodyclass">is-signedin course view-outline</%block>
@@ -71,7 +73,7 @@ from openedx.core.djangoapps.self_paced.models import SelfPacedConfiguration
                       % for component_parent_url, component_display_name in deprecated_blocks_info['blocks']:
                           <li class="nav-item">
                                 % if component_display_name:
-                                    <a href="${component_parent_url}">${_(component_display_name)}</a>
+                                    <a href="${component_parent_url}">${component_display_name}</a>
                                 % else:
                                     <a href="${component_parent_url}">${_("Deprecated Component")}</a>
                                 % endif
@@ -85,9 +87,10 @@ from openedx.core.djangoapps.self_paced.models import SelfPacedConfiguration
             % if deprecated_blocks_info.get('block_types_enabled'):
               <div class="advance-modules-list">
                 <p class="advance-modules-remove-text">
-                  ${_("To avoid errors, {platform_name} strongly recommends that you remove unsupported features from the course advanced settings. To do this, go to the {link_start}Advanced Settings page{link_end}, locate the \"Advanced Module List\" setting, and then delete the following modules from the list.").format(
+                  ${Text(_("To avoid errors, {platform_name} strongly recommends that you remove unsupported features from the course advanced settings. To do this, go to the {link_start}Advanced Settings page{link_end}, locate the \"Advanced Module List\" setting, and then delete the following modules from the list.")).format(
                     platform_name=static.get_platform_name(),
-                    link_start='<a href="{advance_settings_url}">'.format(advance_settings_url=deprecated_blocks_info['advance_settings_url']), link_end="</a>"
+                    link_start=HTML('<a href="{advance_settings_url}">').format(advance_settings_url=deprecated_blocks_info['advance_settings_url']),
+                    link_end=HTML("</a>")
                   )}
                 </p>
                 <nav class="nav-related" aria-label="${_('Unsupported Advance Modules')}">
@@ -178,7 +181,7 @@ from openedx.core.djangoapps.self_paced.models import SelfPacedConfiguration
                 course_locator = context_course.location
                 %>
                 <h2 class="sr">${_("Course Outline")}</h2>
-                <article class="outline outline-complex outline-course" data-locator="${course_locator | h}" data-course-key="${course_locator.course_key | h}">
+                <article class="outline outline-complex outline-course" data-locator="${course_locator}" data-course-key="${course_locator.course_key}">
                 </article>
             </div>
             <div class="ui-loading">
@@ -196,7 +199,7 @@ from openedx.core.djangoapps.self_paced.models import SelfPacedConfiguration
                 <p>${_("Select the Configure icon for a section or subsection to set its release date. When you configure a subsection, you can also set the grading policy and due date.")}</p>
                 <h3 class="title-3">${_("Changing the content students see")}</h3>
                 <p>${_("To publish draft content, select the Publish icon for a section, subsection, or unit.")}</p>
-                <p>${_("To hide content from students, select the Configure icon for a section, subsection, or unit, then select {em_start}Hide from students{em_end}.").format(em_start='<strong>', em_end="</strong>")}</p>
+                <p>${Text(_("To hide content from students, select the Configure icon for a section, subsection, or unit, then select {em_start}Hide from students{em_end}.")).format(em_start=HTML("<strong>"), em_end=HTML("</strong>"))}</p>
             </div>
             <div class="bit external-help">
                 <a href="${get_online_help_info(online_help_token())['doc_url']}" target="_blank" class="button external-help-button">${_("Learn more about the course outline")}</a>

cms/templates/js/asset-library.underscore

@@ -2,7 +2,7 @@
     <div id="asset-paging-header"></div>
 
     <table class="assets-table">
-        <caption class="sr"><%= gettext("List of uploaded files and assets in this course") %></caption>
+        <caption class="sr"><%- gettext("List of uploaded files and assets in this course") %></caption>
         <colgroup>
             <col class="thumb-cols" />
             <col class="name-cols" />
@@ -13,17 +13,17 @@
         </colgroup>
         <thead>
         <tr>
-            <th class="thumb-col"><%= gettext("Preview") %></th>
+            <th class="thumb-col"><%- gettext("Preview") %></th>
             <th class="name-col sortable-column">
                 <span class="column-sort-link" id="js-asset-name-col" role="button" tabindex="0">
-                    <%= gettext("Name") %>
-                    <span class="sr"><%= gettext("- Sortable") %></span>
+                    <%- gettext("Name") %>
+                    <span class="sr"><%- gettext("- Sortable") %></span>
                 </span>
             </th>
             <th class="type-col filterable-column nav-dd">
                 <div id="js-asset-type-col" class="nav-item" role="button" tabindex="0">
                     <span class="title">
-                        <span class="type-filter" data-alllabel='<%= gettext("Type") %>'><%= gettext("Type") %></span>
+                        <span class="type-filter" data-alllabel='<%- gettext("Type") %>'><%- gettext("Type") %></span>
                         <span class="label-prefix sr">Filter</span>
                         <span class="filter-link"></span>
                         <i class="fa fa-caret-down ui-toggle-dd" aria-hidden="true"></i>
@@ -32,15 +32,15 @@
                         <div class="nav-sub">
                             <ul>
                                 <li class="nav-item reset-filter">
-                                    <a class="column-filter-link" href="" data-assetfilter="ALL"><%= gettext("Show All") %></a>
+                                    <a class="column-filter-link" href="" data-assetfilter="ALL"><%- gettext("Show All") %></a>
                                 </li>
                             <% _.each(typeData, function(type, key){ %>
                                 <li class="nav-item">
-                                    <a class="column-filter-link" href="" data-assetfilter="<%= type %>"><%= type %></a>
+                                    <a class="column-filter-link" href="" data-assetfilter="<%- type %>"><%- type %></a>
                                 </li>
                             <% }) %>
                                 <li class="nav-item">
-                                    <a class="column-filter-link" href="" data-assetfilter="OTHER"><%= gettext("Other") %></a>
+                                    <a class="column-filter-link" href="" data-assetfilter="OTHER"><%- gettext("Other") %></a>
                                 </li>
                             </ul>
                         </div>
@@ -49,12 +49,12 @@
             </th>
             <th class="date-col sortable-column">
                 <span class="column-sort-link" id="js-asset-date-col">
-                    <%= gettext("Date Added") %>
-                    <span class="sr"><%= gettext("- Sortable") %></span>
+                    <%- gettext("Date Added") %>
+                    <span class="sr"><%- gettext("- Sortable") %></span>
                 </span>
             </th>
-            <th class="embed-col"><%= gettext("URL") %></th>
-            <th class="actions-col"><span class="sr"><%= gettext("Actions") %></span></th>
+            <th class="embed-col"><%- gettext("URL") %></th>
+            <th class="actions-col"><span class="sr"><%- gettext("Actions") %></span></th>
         </tr>
         </thead>
         <tbody id="asset-table-body"></tbody>
@@ -64,5 +64,5 @@
 </div>
 
 <div class="no-asset-content">
-    <p><%= gettext("You haven't added any assets to this course yet.") %> <a href="#" class="button new-button upload-button"><i class="icon fa fa-plus" aria-hidden="true"></i><%= gettext("Upload your first asset") %></a></p>
+    <p><%- gettext("You haven't added any assets to this course yet.") %> <a href="#" class="button new-button upload-button"><i class="icon fa fa-plus" aria-hidden="true"></i><%- gettext("Upload your first asset") %></a></p>
 </div>

cms/templates/js/asset.underscore

 <td class="thumb-col">
     <div class="thumb">
         <% if (thumbnail !== '') { %>
-        <img src="<%= thumbnail %>" alt="<%= gettext('No description available') %>">
+        <img src="<%- thumbnail %>" alt="<%- gettext('No description available') %>">
         <% } %>
     </div>
 </td>
 <td class="name-col">
-    <span class="title"><a data-tooltip="<%= gettext('Open/download this file') %>" href="<%= url %>" class="filename"><%= display_name %></a></span>
+    <span class="title"><a data-tooltip="<%- gettext('Open/download this file') %>" href="<%- url %>" class="filename"><%- display_name %></a></span>
 
     <div class="embeddable-xml"></div>
 </td>
 <td class="type-col">
-    <%= asset_type %>
+    <%- asset_type %>
 </td>
 <td class="date-col">
-    <%= date_added %>
+    <%- date_added %>
 </td>
 <td class="embed-col">
     <ul>
         <li class="embed-url">
             <label>
-                <span class="label"><%= gettext('Studio:') %></span>
-                <input type="text" class="embeddable-xml-input" value="<%= portable_url %>" readonly>
+                <span class="label"><%- gettext('Studio:') %></span>
+                <input type="text" class="embeddable-xml-input" value="<%- portable_url %>" readonly>
             </label>
         </li>
         <li class="external-url">
             <label>
-                <span class="label"><%= gettext('Web:') %></span>
-                <input type="text" class="embeddable-xml-input" value="<%= external_url %>" readonly>
+                <span class="label"><%- gettext('Web:') %></span>
+                <input type="text" class="embeddable-xml-input" value="<%- external_url %>" readonly>
             </label>
         </li>
     </ul>
@@ -36,11 +36,11 @@
 <td class="actions-col">
     <ul class="actions-list">
         <li class="action-item action-delete">
-            <a href="#" data-tooltip="<%= gettext('Delete this asset') %>" class="remove-asset-button action-button"><i class="icon fa fa-times-circle" aria-hidden="true"></i> <span class="sr"><%= gettext('Delete this asset') %></span></a>
+            <a href="#" data-tooltip="<%- gettext('Delete this asset') %>" class="remove-asset-button action-button"><i class="icon fa fa-times-circle" aria-hidden="true"></i> <span class="sr"><%- gettext('Delete this asset') %></span></a>
         </li>
         <li class="action-item action-lock">
-            <label for="<%= uniqueId %>"><span class="sr"><%= gettext('Lock this asset') %></span></label>
-            <input type="checkbox" id="<%= uniqueId %>" class="lock-checkbox" data-tooltip="<%= gettext('Lock/unlock file') %>" />
+            <label for="<%- uniqueId %>"><span class="sr"><%- gettext('Lock this asset') %></span></label>
+            <input type="checkbox" id="<%- uniqueId %>" class="lock-checkbox" data-tooltip="<%- gettext('Lock/unlock file') %>" />
             <div class="action-button"><i class="icon fa fa-lock"></i><i class="icon fa fa-unlock-alt" aria-hidden="true"></i></div>
         </li>
     </ul>