diff --git a/src/tools/xml_tools.py b/src/tools/xml_tools.py index c3ec4680..371d4d6e 100644 --- a/src/tools/xml_tools.py +++ b/src/tools/xml_tools.py @@ -29,11 +29,15 @@ from twisted.words.protocols.jabber import jid from twisted.internet import defer from sat.core import exceptions from collections import OrderedDict +import htmlentitydefs +import re """This library help manage XML used in SàT (parameters, registration, etc)""" SAT_FORM_PREFIX = "SAT_FORM_" SAT_PARAM_SEPARATOR = "_XMLUI_PARAM_" # used to have unique elements names +html_entity_re = re.compile(r'&([a-zA-Z]+?);') +XML_ENTITIES = ('quot', 'amp', 'apos', 'lt', 'gt') # Helper functions @@ -1320,11 +1324,20 @@ def deferConfirm(*args, **kwargs): # Misc other funtions class ElementParser(object): - """callable class to parse XML string into Element + """callable class to parse XML string into Element""" + # XXX: Found at http://stackoverflow.com/questions/2093400/how-to-create-twisted-words-xish-domish-element-entirely-from-raw-xml/2095942#2095942 - Found at http://stackoverflow.com/questions/2093400/how-to-create-twisted-words-xish-domish-element-entirely-from-raw-xml/2095942#2095942 - (c) Karl Anderson - """ + def _escapeHTML(self, matchobj): + entity = matchobj.group(1) + if entity in XML_ENTITIES: + # we don't escape XML entities + return matchobj.group(0) + else: + try: + return unichr(htmlentitydefs.name2codepoint[entity]) + except KeyError: + log.warning(u"removing unknown entity {}".format(entity)) + return u'' def __call__(self, raw_xml, force_spaces=False, namespace=None): """ @@ -1339,6 +1352,9 @@ class ElementParser(object): else: raw_xml = u"