From 0ef57eb136914a4dd0de1396095c80d8eddf73ac Mon Sep 17 00:00:00 2001
From: Agrendalath <piotr@surowiec.it>
Date: Mon, 25 Oct 2021 21:15:45 +0200
Subject: [PATCH] fix: do not index solutions in CAPA blocks

Most tags that could contain solutions or hints were already being removed,
but the regex did not include the case when they contained attributes.
---
 common/lib/xmodule/xmodule/capa_module.py     | 18 ++++++---
 .../xmodule/xmodule/tests/test_capa_module.py | 37 +++++++++++--------
 2 files changed, 35 insertions(+), 20 deletions(-)

diff --git a/common/lib/xmodule/xmodule/capa_module.py b/common/lib/xmodule/xmodule/capa_module.py
index 33dfc3ed61..064c0c81f8 100644
--- a/common/lib/xmodule/xmodule/capa_module.py
+++ b/common/lib/xmodule/xmodule/capa_module.py
@@ -552,14 +552,22 @@ class ProblemBlock(
         # Make optioninput's options index friendly by replacing the actual tag with the values
         capa_content = re.sub(r'<optioninput options="\(([^"]+)\)".*?>\s*|\S*<\/optioninput>', r'\1', self.data)
 
-        # Removing solutions and hints, as well as script and style
+        # Remove the following tags with content that can leak hints or solutions:
+        # - `solution` (with optional attributes) and `solutionset`.
+        # - `targetedfeedback` (with optional attributes) and `targetedfeedbackset`.
+        # - `answer` (with optional attributes).
+        # - `script` (with optional attributes).
+        # - `style` (with optional attributes).
+        # - various types of hints (with optional attributes) and `hintpart`.
         capa_content = re.sub(
             re.compile(
                 r"""
-                    <solution>.*?</solution> |
-                    <script>.*?</script> |
-                    <style>.*?</style> |
-                    <[a-z]*hint.*?>.*?</[a-z]*hint>
+                    <solution.*?>.*?</solution.*?> |
+                    <targetedfeedback.*?>.*?</targetedfeedback.*?> |
+                    <answer.*?>.*?</answer> |
+                    <script.*?>.*?</script> |
+                    <style.*?>.*?</style> |
+                    <[a-z]*hint.*?>.*?</[a-z]*hint.*?>
                 """,
                 re.DOTALL |
                 re.VERBOSE),
diff --git a/common/lib/xmodule/xmodule/tests/test_capa_module.py b/common/lib/xmodule/xmodule/tests/test_capa_module.py
index 2b2b8e3428..26ff575f81 100644
--- a/common/lib/xmodule/xmodule/tests/test_capa_module.py
+++ b/common/lib/xmodule/xmodule/tests/test_capa_module.py
@@ -2562,25 +2562,32 @@ class ProblemBlockXMLTest(unittest.TestCase):  # lint-amnesty, pylint: disable=m
     def test_solutions_not_indexed(self):
         xml = textwrap.dedent("""
             <problem>
-                <solution>
-                <div class="detailed-solution">
-                <p>Explanation</p>
+                <solution>Test solution.</solution>
+                <solution explanation-id="solution0">Test solution with attribute.</solution>
+                <solutionset>
+                    Test solutionset.
+                    <solution explanation-id="solution1">Test solution within solutionset.</solution>
+                </solutionset>
 
-                <p>This is what the 1st solution.</p>
+                <targetedfeedback>Test feedback.</targetedfeedback>
+                <targetedfeedback explanation-id="feedback0">Test feedback with attribute.</targetedfeedback>
+                <targetedfeedbackset>
+                    Test FeedbackSet.
+                    <targetedfeedback explanation-id="feedback1">Test feedback within feedbackset.</targetedfeedback>
+                </targetedfeedbackset>
 
-                </div>
-                </solution>
+                <answer>Test answer.</answer>
+                <answer type="loncapa/python">Test answer with attribute.</answer>
 
-                <solution>
-                <div class="detailed-solution">
-                <p>Explanation</p>
-
-                <p>This is the 2nd solution.</p>
-
-                </div>
-                </solution>
+                <script>Test script.</script>
+                <script type="loncapa/python">Test script with attribute.</script>
 
+                <style>Test style.</style>
+                <style media="all and (max-width: 1920px)">Test style with attribute.</style>
 
+                <choicehint>Test choicehint.</choicehint>
+                <hint>Test hint.</hint>
+                <hintpart>Test hintpart.</hintpart>
             </problem>
         """)
         name = "Blank Common Capa Problem"
@@ -2695,7 +2702,7 @@ class ProblemBlockXMLTest(unittest.TestCase):  # lint-amnesty, pylint: disable=m
         """)
         name = "Non latin Input"
         descriptor = self._create_descriptor(sample_text_input_problem_xml, name=name)
-        capa_content = " FX1_VAL='Καλημέρα' Δοκιμή με μεταβλητές με Ελληνικούς χαρακτήρες μέσα σε python: $FX1_VAL "
+        capa_content = " Δοκιμή με μεταβλητές με Ελληνικούς χαρακτήρες μέσα σε python: $FX1_VAL "
 
         descriptor_dict = descriptor.index_dictionary()
         assert descriptor_dict['content']['capa_content'] == smart_str(capa_content)