plugin extra_pep, params: fixed insecure building of jids_list

src/memory/params.py

@@ -27,6 +27,7 @@ from sat.core.log import getLogger
 log = getLogger(__name__)
 from twisted.internet import defer
 from twisted.python.failure import Failure
+from twisted.words.xish import domish
 from twisted.words.protocols.jabber import jid
 from sat.tools.xml_tools import paramsXML2XMLUI, getText
 
@@ -35,6 +36,18 @@ from sat.tools.xml_tools import paramsXML2XMLUI, getText
 #       this need an overall simplification to make maintenance easier
 
 
+def createJidElts(jids):
+    """Generator which return <jid/> elements from jids
+
+    @param jids(iterable[id.jID]): jids to use
+    @return (generator[domish.Element]): <jid/> elements
+    """
+    for jid_ in jids:
+        jid_elt = domish.Element((None, 'jid'))
+        jid_elt.addContent(jid_.full())
+        yield jid_elt
+
+
 class Params(object):
     """This class manage parameters with xml"""
     ### TODO: add desciption in params

src/plugins/plugin_misc_extra_pep.py

@@ -20,6 +20,8 @@
 from sat.core.i18n import _, D_
 from sat.core.log import getLogger
 log = getLogger(__name__)
+from sat.memory import params
+from twisted.words.protocols.jabber import jid
 
 
 PLUGIN_INFO = {
@@ -34,9 +36,11 @@ PLUGIN_INFO = {
     "description": _(u"""Display messages from extra PEP services""")
 }
 
+
 PARAM_KEY = u"Misc"
 PARAM_NAME = u"Blog authors following list"
-PARAM_DEFAULT = ["salut-a-toi@libervia.org"]
+PARAM_DEFAULT = (jid.JID("salut-a-toi@libervia.org"),)
+
 
 class ExtraPEP(object):
 
@@ -55,7 +59,7 @@ class ExtraPEP(object):
         'category_label': D_(PARAM_KEY),
         'param_name': PARAM_NAME,
         'param_label': D_(PARAM_NAME),
-        'jids': "".join(["<jid>%s</jid>" % jid for jid in PARAM_DEFAULT])
+        'jids': u"\n".join({elt.toXml() for elt in params.createJidElts(PARAM_DEFAULT)})
     }
 
     def __init__(self, host):