Commit Graph

11 Commits

Author SHA1 Message Date
M. Zulqarnain
2c44315ce0 refactor: pyupgrade on pavelib & scripts (#26769) 2021-03-12 14:14:53 +05:00
Aarif
6af99e64bf replaced unittest assertions pytest assertions (#26270) 2021-02-04 10:08:39 +05:00
Samuel Walladge
71fcf6e725 Fix issues with xss linters
Improve accuracy of javascript-escape linter: Previously this would
match on FOOescape() and FOO.escape calls, but neither are the global
escape function we are worried about.

The regex probably isn't 100% accurate; there may be still false
positives (javascript allows a large range of characters in identifiers,
some of which may not be covered by [\w.$]). The main thing is to avoid
false negatives here though - this will definitely catch any use of
`escape()` or `window.escape()`.

Also remove javascript-interpolate lint - this was deemed unecessary.
StringUtils.interpolate is not in fact safe (it does no html escaping),
so the results of this lint are misleading.
2020-05-04 09:27:18 +09:30
Feanil Patel
9cf2f9f298 Run 2to3 -f future . -w
This will remove imports from __future__ that are no longer needed.

https://docs.python.org/3.5/library/2to3.html#2to3fixer-future
2019-12-30 10:35:30 -05:00
Feanil Patel
f59258446f Fix test collection for XSS lint tests.
This was failing before because DDT was trying to get an attribute
from an XSS Lint RuleSet object but that was throwing an exception
because the RuleSet object didn't have that attribute.

In python 2 such exceptions were automatically swallowed by the
getattr function but in python 3 they get raised.
2019-09-05 12:43:17 -04:00
Adeel Khan
37c6b60fc8 Adds Django template linter.
This adds Django template linter that
would check for all trans/blocktrans
tag expressions for escaping.

PROD-465
2019-07-25 18:54:03 +05:00
aarif
0bf108ea8a ran python-modernize and isort on files mentioned in INCR-387 2019-07-10 15:47:38 +05:00
Matt Hughes
2f9819f247 Improve XSS lint for underscore templates
See also
https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/conventions/preventing_xss.html#javascript-edx-namespace

The failure totals in test_main appear to've been wrong previously;
I'm just updating them to run clean via `pytest scripts/xsslint/tests`
2019-02-07 13:54:52 -05:00
Anthony Mangano
edc98939b5 Define XSS-linter rules on Linter classes. 2018-03-23 16:58:27 -04:00
Anthony Mangano
3e7df8688f Add config module for xsslint 2018-03-01 16:52:42 -05:00
Anthony Mangano
07ca440226 Refactor XSS linter into smaller files 2018-03-01 09:46:16 -05:00