diff --git a/scripts/xsslint/tests/test_linters.py b/scripts/xsslint/tests/test_linters.py index bc7f560fbb..069b45656b 100644 --- a/scripts/xsslint/tests/test_linters.py +++ b/scripts/xsslint/tests/test_linters.py @@ -190,6 +190,7 @@ class TestUnderscoreTemplateLinter(TestLinter): self.assertEqual(results.violations[1].is_disabled, False) @data( + {'template': '<%= edx.HtmlUtils.ensureHtml(message) %>'}, {'template': '<%= HtmlUtils.ensureHtml(message) %>'}, {'template': '<%= _.escape(message) %>'}, ) diff --git a/scripts/xsslint/tests/test_main.py b/scripts/xsslint/tests/test_main.py index e8e272131b..c0cef69bfe 100644 --- a/scripts/xsslint/tests/test_main.py +++ b/scripts/xsslint/tests/test_main.py @@ -93,7 +93,7 @@ class TestXSSLinter(TestCase): # Assert no rule totals. self.assertIsNone(re.search(r'{}:\s*{} violations'.format(self.ruleset.python_parse_error.rule_id, 0), output)) # Assert final total - self.assertIsNotNone(re.search(r'{} violations total'.format(7), output)) + self.assertIsNotNone(re.search(r'{} violations total'.format(5), output)) def test_lint_with_verbose(self): """ @@ -125,7 +125,7 @@ class TestXSSLinter(TestCase): # Assert no rule totals. self.assertIsNone(re.search(r'{}:\s*{} violations'.format(self.ruleset.python_parse_error.rule_id, 0), output)) # Assert final total - self.assertIsNotNone(re.search(r'{} violations total'.format(7), output)) + self.assertIsNotNone(re.search(r'{} violations total'.format(5), output)) def test_lint_with_rule_totals(self): """ @@ -150,7 +150,7 @@ class TestXSSLinter(TestCase): # Assert totals output. self.assertIsNotNone(re.search(r'{}:\s*{} violations'.format(self.ruleset.python_parse_error.rule_id, 0), output)) self.assertIsNotNone(re.search(r'{}:\s*{} violations'.format(self.ruleset.python_wrap_html.rule_id, 1), output)) - self.assertIsNotNone(re.search(r'{} violations total'.format(7), output)) + self.assertIsNotNone(re.search(r'{} violations total'.format(5), output)) def test_lint_with_list_files(self): """ diff --git a/scripts/xsslint/xsslint/linters.py b/scripts/xsslint/xsslint/linters.py index 953cc5d8b2..840b2fce98 100644 --- a/scripts/xsslint/xsslint/linters.py +++ b/scripts/xsslint/xsslint/linters.py @@ -268,6 +268,7 @@ class UnderscoreTemplateLinter(BaseLinter): Safe examples:: + <%= edx.HtmlUtils.ensureHtml(message) %> <%= HtmlUtils.ensureHtml(message) %> <%= _.escape(message) %> @@ -278,6 +279,8 @@ class UnderscoreTemplateLinter(BaseLinter): True if the Expression has been safely escaped, and False otherwise. """ + if expression.expression_inner.startswith('edx.HtmlUtils.'): + return True if expression.expression_inner.startswith('HtmlUtils.'): return True if expression.expression_inner.startswith('_.escape('):