Mercurial > genshi > genshi-test
annotate markup/filters.py @ 12:87238328a71d
Make the XInclude filter track namespace context, to enable it to omit `END_NS` events for the XInclude namespace.
author | cmlenz |
---|---|
date | Sun, 04 Jun 2006 20:37:59 +0000 |
parents | c5890ef863ba |
children | bf9de5a4c896 |
rev | line source |
---|---|
1 | 1 # -*- coding: utf-8 -*- |
2 # | |
3 # Copyright (C) 2006 Christopher Lenz | |
4 # All rights reserved. | |
5 # | |
6 # This software is licensed as described in the file COPYING, which | |
7 # you should have received as part of this distribution. The terms | |
8 # are also available at http://trac.edgewall.com/license.html. | |
9 # | |
10 # This software consists of voluntary contributions made by many | |
11 # individuals. For the exact contribution history, see the revision | |
12 # history and logs, available at http://projects.edgewall.com/trac/. | |
13 | |
14 """Implementation of a number of stream filters.""" | |
15 | |
16 try: | |
17 frozenset | |
18 except NameError: | |
19 from sets import ImmutableSet as frozenset | |
20 import re | |
21 | |
22 from markup.core import Attributes, Markup, Stream | |
23 from markup.path import Path | |
24 | |
25 __all__ = ['EvalFilter', 'IncludeFilter', 'MatchFilter', 'WhitespaceFilter', | |
26 'HTMLSanitizer'] | |
27 | |
28 | |
29 class EvalFilter(object): | |
30 """Responsible for evaluating expressions in a template.""" | |
31 | |
32 def __call__(self, stream, ctxt=None): | |
10
c5890ef863ba
Moved the template-specific stream event kinds into the template module.
cmlenz
parents:
1
diff
changeset
|
33 from markup.template import Template |
c5890ef863ba
Moved the template-specific stream event kinds into the template module.
cmlenz
parents:
1
diff
changeset
|
34 |
1 | 35 for kind, data, pos in stream: |
36 | |
37 if kind is Stream.START: | |
38 # Attributes may still contain expressions in start tags at | |
39 # this point, so do some evaluation | |
40 tag, attrib = data | |
41 new_attrib = [] | |
42 for name, substream in attrib: | |
43 if isinstance(substream, basestring): | |
44 value = substream | |
45 else: | |
46 values = [] | |
47 for subkind, subdata, subpos in substream: | |
10
c5890ef863ba
Moved the template-specific stream event kinds into the template module.
cmlenz
parents:
1
diff
changeset
|
48 if subkind is Template.EXPR: |
1 | 49 values.append(subdata.evaluate(ctxt)) |
50 else: | |
51 values.append(subdata) | |
52 value = filter(lambda x: x is not None, values) | |
53 if not value: | |
54 continue | |
55 new_attrib.append((name, ''.join(value))) | |
56 yield kind, (tag, Attributes(new_attrib)), pos | |
57 | |
10
c5890ef863ba
Moved the template-specific stream event kinds into the template module.
cmlenz
parents:
1
diff
changeset
|
58 elif kind is Template.EXPR: |
1 | 59 result = data.evaluate(ctxt) |
60 if result is None: | |
61 continue | |
62 | |
63 # First check for a string, otherwise the iterable | |
64 # test below succeeds, and the string will be | |
65 # chopped up into characters | |
66 if isinstance(result, basestring): | |
67 yield Stream.TEXT, result, pos | |
68 else: | |
69 # Test if the expression evaluated to an | |
70 # iterable, in which case we yield the | |
71 # individual items | |
72 try: | |
10
c5890ef863ba
Moved the template-specific stream event kinds into the template module.
cmlenz
parents:
1
diff
changeset
|
73 yield Template.SUB, ([], iter(result)), pos |
1 | 74 except TypeError: |
75 # Neither a string nor an iterable, so just | |
76 # pass it through | |
77 yield Stream.TEXT, unicode(result), pos | |
78 | |
79 else: | |
80 yield kind, data, pos | |
81 | |
82 | |
83 class IncludeFilter(object): | |
84 """Template filter providing (very) basic XInclude support | |
85 (see http://www.w3.org/TR/xinclude/) in templates. | |
86 """ | |
87 | |
88 _NAMESPACE = 'http://www.w3.org/2001/XInclude' | |
89 | |
90 def __init__(self, loader): | |
91 """Initialize the filter. | |
92 | |
93 @param loader: the `TemplateLoader` to use for resolving references to | |
94 external template files | |
95 """ | |
96 self.loader = loader | |
97 | |
12
87238328a71d
Make the XInclude filter track namespace context, to enable it to omit `END_NS` events for the XInclude namespace.
cmlenz
parents:
10
diff
changeset
|
98 def __call__(self, stream, ctxt=None, ns_prefixes=None): |
1 | 99 """Filter the stream, processing any XInclude directives it may |
100 contain. | |
101 | |
102 @param ctxt: the template context | |
103 @param stream: the markup event stream to filter | |
104 """ | |
12
87238328a71d
Make the XInclude filter track namespace context, to enable it to omit `END_NS` events for the XInclude namespace.
cmlenz
parents:
10
diff
changeset
|
105 from markup.template import Template, TemplateError, TemplateNotFound |
1 | 106 |
12
87238328a71d
Make the XInclude filter track namespace context, to enable it to omit `END_NS` events for the XInclude namespace.
cmlenz
parents:
10
diff
changeset
|
107 if ns_prefixes is None: |
87238328a71d
Make the XInclude filter track namespace context, to enable it to omit `END_NS` events for the XInclude namespace.
cmlenz
parents:
10
diff
changeset
|
108 ns_prefixes = [] |
1 | 109 in_fallback = False |
110 include_href, fallback_stream = None, None | |
111 indent = 0 | |
112 | |
113 for kind, data, pos in stream: | |
114 | |
115 if kind is Stream.START and data[0].namespace == self._NAMESPACE \ | |
116 and not in_fallback: | |
117 tag, attrib = data | |
118 if tag.localname == 'include': | |
119 include_href = attrib.get('href') | |
120 indent = pos[1] | |
121 elif tag.localname == 'fallback': | |
122 in_fallback = True | |
123 fallback_stream = [] | |
124 | |
125 elif kind is Stream.END and data.namespace == self._NAMESPACE: | |
126 if data.localname == 'include': | |
127 try: | |
128 if not include_href: | |
129 raise TemplateError('Include misses required ' | |
130 'attribute "href"') | |
131 template = self.loader.load(include_href) | |
132 for ikind, idata, ipos in template.generate(ctxt): | |
133 # Fixup indentation of included markup | |
134 if ikind is Stream.TEXT: | |
135 idata = idata.replace('\n', '\n' + ' ' * indent) | |
136 yield ikind, idata, ipos | |
137 | |
138 # If the included template defines any filters added at | |
139 # runtime (such as py:match templates), those need to be | |
140 # applied to the including template, too. | |
141 for filter_ in template.filters: | |
142 stream = filter_(stream, ctxt) | |
143 | |
144 except TemplateNotFound: | |
145 if fallback_stream is None: | |
146 raise | |
147 for event in fallback_stream: | |
148 yield event | |
149 | |
150 include_href = None | |
151 fallback_stream = None | |
152 indent = 0 | |
153 break | |
154 elif data.localname == 'fallback': | |
155 in_fallback = False | |
156 | |
157 elif in_fallback: | |
158 fallback_stream.append((kind, data, pos)) | |
159 | |
160 elif kind is Stream.START_NS and data[1] == self._NAMESPACE: | |
12
87238328a71d
Make the XInclude filter track namespace context, to enable it to omit `END_NS` events for the XInclude namespace.
cmlenz
parents:
10
diff
changeset
|
161 ns_prefixes.append(data[0]) |
87238328a71d
Make the XInclude filter track namespace context, to enable it to omit `END_NS` events for the XInclude namespace.
cmlenz
parents:
10
diff
changeset
|
162 continue |
87238328a71d
Make the XInclude filter track namespace context, to enable it to omit `END_NS` events for the XInclude namespace.
cmlenz
parents:
10
diff
changeset
|
163 |
87238328a71d
Make the XInclude filter track namespace context, to enable it to omit `END_NS` events for the XInclude namespace.
cmlenz
parents:
10
diff
changeset
|
164 elif kind is Stream.END_NS and data in ns_prefixes: |
87238328a71d
Make the XInclude filter track namespace context, to enable it to omit `END_NS` events for the XInclude namespace.
cmlenz
parents:
10
diff
changeset
|
165 ns_prefixes.pop() |
1 | 166 continue |
167 | |
168 else: | |
169 yield kind, data, pos | |
170 else: | |
171 # The loop exited normally, so there shouldn't be further events to | |
172 # process | |
173 return | |
174 | |
12
87238328a71d
Make the XInclude filter track namespace context, to enable it to omit `END_NS` events for the XInclude namespace.
cmlenz
parents:
10
diff
changeset
|
175 for event in self(stream, ctxt, ns_prefixes=ns_prefixes): |
1 | 176 yield event |
177 | |
178 | |
179 class MatchFilter(object): | |
180 """A filter that delegates to a given handler function when the input stream | |
181 matches some path expression. | |
182 """ | |
183 | |
184 def __init__(self, path, handler): | |
185 self.path = Path(path) | |
186 self.handler = handler | |
187 | |
188 def __call__(self, stream, ctxt=None): | |
10
c5890ef863ba
Moved the template-specific stream event kinds into the template module.
cmlenz
parents:
1
diff
changeset
|
189 from markup.template import Template |
c5890ef863ba
Moved the template-specific stream event kinds into the template module.
cmlenz
parents:
1
diff
changeset
|
190 |
1 | 191 test = self.path.test() |
192 for kind, data, pos in stream: | |
193 result = test(kind, data, pos) | |
194 if result is True: | |
195 content = [(kind, data, pos)] | |
196 depth = 1 | |
197 while depth > 0: | |
198 ev = stream.next() | |
199 if ev[0] is Stream.START: | |
200 depth += 1 | |
201 elif ev[0] is Stream.END: | |
202 depth -= 1 | |
203 content.append(ev) | |
204 test(*ev) | |
205 | |
10
c5890ef863ba
Moved the template-specific stream event kinds into the template module.
cmlenz
parents:
1
diff
changeset
|
206 yield (Template.SUB, |
1 | 207 ([lambda stream, ctxt: self.handler(content, ctxt)], []), |
208 pos) | |
209 else: | |
210 yield kind, data, pos | |
211 | |
212 | |
213 class WhitespaceFilter(object): | |
214 """A filter that removes extraneous white space from the stream. | |
215 | |
216 Todo: | |
217 * Support for xml:space | |
218 """ | |
219 | |
220 _TRAILING_SPACE = re.compile('[ \t]+(?=\n)') | |
221 _LINE_COLLAPSE = re.compile('\n{2,}') | |
222 | |
223 def __call__(self, stream, ctxt=None): | |
224 textbuf = [] | |
225 prev_kind = None | |
226 for kind, data, pos in stream: | |
227 if kind is Stream.TEXT: | |
228 textbuf.append(data) | |
229 elif prev_kind is Stream.TEXT: | |
230 text = ''.join(textbuf) | |
231 text = self._TRAILING_SPACE.sub('', text) | |
232 text = self._LINE_COLLAPSE.sub('\n', text) | |
233 yield Stream.TEXT, text, pos | |
234 del textbuf[:] | |
235 prev_kind = kind | |
236 if kind is not Stream.TEXT: | |
237 yield kind, data, pos | |
238 | |
239 if textbuf: | |
240 text = self._LINE_COLLAPSE.sub('\n', ''.join(textbuf)) | |
241 yield Stream.TEXT, text, pos | |
242 | |
243 | |
244 class HTMLSanitizer(object): | |
245 """A filter that removes potentially dangerous HTML tags and attributes | |
246 from the stream. | |
247 """ | |
248 | |
249 _SAFE_TAGS = frozenset(['a', 'abbr', 'acronym', 'address', 'area', 'b', | |
250 'big', 'blockquote', 'br', 'button', 'caption', 'center', 'cite', | |
251 'code', 'col', 'colgroup', 'dd', 'del', 'dfn', 'dir', 'div', 'dl', 'dt', | |
252 'em', 'fieldset', 'font', 'form', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', | |
253 'hr', 'i', 'img', 'input', 'ins', 'kbd', 'label', 'legend', 'li', 'map', | |
254 'menu', 'ol', 'optgroup', 'option', 'p', 'pre', 'q', 's', 'samp', | |
255 'select', 'small', 'span', 'strike', 'strong', 'sub', 'sup', 'table', | |
256 'tbody', 'td', 'textarea', 'tfoot', 'th', 'thead', 'tr', 'tt', 'u', | |
257 'ul', 'var']) | |
258 | |
259 _SAFE_ATTRS = frozenset(['abbr', 'accept', 'accept-charset', 'accesskey', | |
260 'action', 'align', 'alt', 'axis', 'border', 'cellpadding', | |
261 'cellspacing', 'char', 'charoff', 'charset', 'checked', 'cite', 'class', | |
262 'clear', 'cols', 'colspan', 'color', 'compact', 'coords', 'datetime', | |
263 'dir', 'disabled', 'enctype', 'for', 'frame', 'headers', 'height', | |
264 'href', 'hreflang', 'hspace', 'id', 'ismap', 'label', 'lang', | |
265 'longdesc', 'maxlength', 'media', 'method', 'multiple', 'name', | |
266 'nohref', 'noshade', 'nowrap', 'prompt', 'readonly', 'rel', 'rev', | |
267 'rows', 'rowspan', 'rules', 'scope', 'selected', 'shape', 'size', | |
268 'span', 'src', 'start', 'style', 'summary', 'tabindex', 'target', | |
269 'title', 'type', 'usemap', 'valign', 'value', 'vspace', 'width']) | |
270 _URI_ATTRS = frozenset(['action', 'background', 'dynsrc', 'href', 'lowsrc', | |
271 'src']) | |
272 _SAFE_SCHEMES = frozenset(['file', 'ftp', 'http', 'https', 'mailto', None]) | |
273 | |
274 def __call__(self, stream, ctxt=None): | |
275 waiting_for = None | |
276 | |
277 for kind, data, pos in stream: | |
278 if kind is Stream.START: | |
279 if waiting_for: | |
280 continue | |
281 tag, attrib = data | |
282 if tag not in self._SAFE_TAGS: | |
283 waiting_for = tag | |
284 continue | |
285 | |
286 new_attrib = [] | |
287 for attr, value in attrib: | |
288 if attr not in self._SAFE_ATTRS: | |
289 continue | |
290 elif attr in self._URI_ATTRS: | |
291 # Don't allow URI schemes such as "javascript:" | |
292 if self._get_scheme(value) not in self._SAFE_SCHEMES: | |
293 continue | |
294 elif attr == 'style': | |
295 # Remove dangerous CSS declarations from inline styles | |
296 decls = [] | |
297 for decl in filter(None, value.split(';')): | |
298 is_evil = False | |
299 if 'expression' in decl: | |
300 is_evil = True | |
301 for m in re.finditer(r'url\s*\(([^)]+)', decl): | |
302 if self._get_scheme(m.group(1)) not in self._SAFE_SCHEMES: | |
303 is_evil = True | |
304 break | |
305 if not is_evil: | |
306 decls.append(decl.strip()) | |
307 if not decls: | |
308 continue | |
309 value = '; '.join(decls) | |
310 new_attrib.append((attr, value)) | |
311 | |
312 yield kind, (tag, new_attrib), pos | |
313 | |
314 elif kind is Stream.END: | |
315 tag = data | |
316 if waiting_for: | |
317 if waiting_for == tag: | |
318 waiting_for = None | |
319 else: | |
320 yield kind, data, pos | |
321 | |
322 else: | |
323 if not waiting_for: | |
324 yield kind, data, pos | |
325 | |
326 def _get_scheme(self, text): | |
327 if ':' not in text: | |
328 return None | |
329 chars = [char for char in text.split(':', 1)[0] if char.isalnum()] | |
330 return ''.join(chars).lower() |