diff --git a/docs/labs/xss.js b/docs/labs/xss.js index 8bf8bc0c..23a6f406 100644 --- a/docs/labs/xss.js +++ b/docs/labs/xss.js @@ -2,40 +2,65 @@ info = { hints: [ { - absent: "autoescape", - text: "Add an `autoescape=` parameter." + present: "(Autoescape|AUTOESCAPE)", + text: "The name `autoescape` must be in all lowercase.", + examples: [ + [ "Autoescape" ], + ], }, { - present: String.raw`autoescape [^:\x20]`, - text: "The name `autoescape` needs to be followed by `=`." + present: "([Aa]uto_[Ee]scape|AUTO_ESCAPE)", + text: "Use `autoescape` in all lowercase with no underscores.", + examples: [ + [ "auto_escape" ], + ], }, { - present: "(Autoescape|AUTOESCAPE)", - text: "The name `autoescape` must be in all lowercase." + absent: "autoescape", + text: "Add an `autoescape=` parameter.", + examples: [ + [ "" ], + ], }, { - present: "([Aa]uto_[Ee]scape|AUTO_ESCAPE)", - text: "Use `autoescape` in all lowercase with no underscores." + present: 'autoescape', + absent: String.raw`autoescape\x20*=`, + text: "The name `autoescape` needs to be followed by `=`.", + examples: [ + [ "autoescape" ], + ], }, { present: String.raw`\| safe`, index: 1, - text: "The text `| safe` indicates that this text is trusted and should not be escaped further. However, in context this data could be provided from an attacker and is NOT safe. Remove the marking." + text: "The text `| safe` indicates that this text is trusted and should not be escaped further. However, in context this data could be provided from an attacker and is NOT safe. Remove the marking.", + examples: [ + [ null, "

Hello {{ person | safe }}!

" ], + ], }, { present: String.raw`\|`, index: 1, - text: "The `|` is used to separate the computed value from the safe marking, but we will not use that marking. Remove the vertical bar." + text: "The `|` is used to separate the computed value from the safe marking, but we will not use that marking. Remove the vertical bar.", + examples: [ + [ null, "

Hello {{ person | }}!

" ], + ], }, { present: String.raw`Markup \(.*\+.*\)`, index: 2, - text: "Having a concatenation (+) *inside* the call to Markup is a vulnerability. The call to Markup presumes we are passing text that is *not* supposed be escaped. If it is supposed to be escaped, it should be concatenated outside the initial construction of the Markup object." + text: "Having a concatenation (+) *inside* the call to Markup is a vulnerability. The call to Markup presumes we are passing text that is *not* supposed be escaped. If it is supposed to be escaped, it should be concatenated outside the initial construction of the Markup object.", + examples: [ + [ null, null, " result = Markup('Original name=' + name)" ], + ], }, { absent: String.raw`\+`, index: 2, - text: "Our expected answer includes concatentation using `+`. We expect something like `Markup('Original name='` followed by `+` followed by the variable containing the data that needs to be escaped." + text: "Our expected answer includes concatentation using `+`. We expect something like `Markup('Original name='` followed by `+` followed by the variable containing the data that needs to be escaped.", + examples: [ + [ null, null, ' result = Markup(f"Original name={name}' ], + ], }, ], expected: [ @@ -44,6 +69,8 @@ info = `result = Markup('Original name=') + name` ], correct: [ + // Python PEP 8 recommends no space '=' around keyword use, but + // Python allows it, so we will too. String.raw`\s* autoescape = select_autoescape \( \) \s*`, String.raw`\s* < h1 >Hello\x20{{ person }}!< /h1 > \s*`, String.raw`\s* result = Markup \( ('Original name='|"Original name=") \) \+ name \s*`