From 77c3e83ec8a247f0c4b87a14f51438251d1ea8ae Mon Sep 17 00:00:00 2001
From: Goffi <goffi@goffi.org>
Date: Tue, 15 Dec 2015 16:25:19 +0100
Subject: [PATCH] plugin extra_pep, params: fixed insecure building of
 jids_list

---
 src/memory/params.py                 | 13 +++++++++++++
 src/plugins/plugin_misc_extra_pep.py |  8 ++++++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/memory/params.py b/src/memory/params.py
index b12e5325..541a483a 100644
--- a/src/memory/params.py
+++ b/src/memory/params.py
@@ -27,6 +27,7 @@ from sat.core.log import getLogger
 log = getLogger(__name__)
 from twisted.internet import defer
 from twisted.python.failure import Failure
+from twisted.words.xish import domish
 from twisted.words.protocols.jabber import jid
 from sat.tools.xml_tools import paramsXML2XMLUI, getText
 
@@ -35,6 +36,18 @@ from sat.tools.xml_tools import paramsXML2XMLUI, getText
 #       this need an overall simplification to make maintenance easier
 
 
+def createJidElts(jids):
+    """Generator which return <jid/> elements from jids
+
+    @param jids(iterable[id.jID]): jids to use
+    @return (generator[domish.Element]): <jid/> elements
+    """
+    for jid_ in jids:
+        jid_elt = domish.Element((None, 'jid'))
+        jid_elt.addContent(jid_.full())
+        yield jid_elt
+
+
 class Params(object):
     """This class manage parameters with xml"""
     ### TODO: add desciption in params
diff --git a/src/plugins/plugin_misc_extra_pep.py b/src/plugins/plugin_misc_extra_pep.py
index 294c850f..4798959a 100644
--- a/src/plugins/plugin_misc_extra_pep.py
+++ b/src/plugins/plugin_misc_extra_pep.py
@@ -20,6 +20,8 @@
 from sat.core.i18n import _, D_
 from sat.core.log import getLogger
 log = getLogger(__name__)
+from sat.memory import params
+from twisted.words.protocols.jabber import jid
 
 
 PLUGIN_INFO = {
@@ -34,9 +36,11 @@ PLUGIN_INFO = {
     "description": _(u"""Display messages from extra PEP services""")
 }
 
+
 PARAM_KEY = u"Misc"
 PARAM_NAME = u"Blog authors following list"
-PARAM_DEFAULT = ["salut-a-toi@libervia.org"]
+PARAM_DEFAULT = (jid.JID("salut-a-toi@libervia.org"),)
+
 
 class ExtraPEP(object):
 
@@ -55,7 +59,7 @@ class ExtraPEP(object):
         'category_label': D_(PARAM_KEY),
         'param_name': PARAM_NAME,
         'param_label': D_(PARAM_NAME),
-        'jids': "".join(["<jid>%s</jid>" % jid for jid in PARAM_DEFAULT])
+        'jids': u"\n".join({elt.toXml() for elt in params.createJidElts(PARAM_DEFAULT)})
     }
 
     def __init__(self, host):