diff --git a/geonode/base/models.py b/geonode/base/models.py index 88181530054..96fbbb5bc7d 100644 --- a/geonode/base/models.py +++ b/geonode/base/models.py @@ -41,6 +41,7 @@ from django.core.files.base import ContentFile from django.contrib.gis.geos import GEOSGeometry from django.utils.timezone import now +from django.utils.html import escape from mptt.models import MPTTModel, TreeForeignKey @@ -383,6 +384,7 @@ def add(self, *tags): tag_objs.update(existing) for new_tag in str_tags - set(t.name for t in existing): if new_tag: + new_tag = escape(new_tag) tag_objs.add(HierarchicalKeyword.add_root(name=new_tag)) for tag in tag_objs: diff --git a/geonode/layers/tests.py b/geonode/layers/tests.py index a68f5275539..f3535018038 100644 --- a/geonode/layers/tests.py +++ b/geonode/layers/tests.py @@ -258,6 +258,17 @@ def test_layer_save(self): u'here', u'keywords', u'populartag', u'saving', u'ß', u'ä', u'ö', u'ü', u'論語']) + # Test input escape + lyr.keywords.add(*["Europe", + "land_covering", + "Science"]) + + self.assertEqual( + lyr.keyword_list(), [ + u'<IMG SRC='javascript:true;'>Science', u'Europe<script>true;</script>', + u'here', u'keywords', u'land_<script>true;</script>covering', u'populartag', u'saving', + u'ß', u'ä', u'ö', u'ü', u'論語']) + self.client.login(username='admin', password='admin') response = self.client.get(reverse('layer_detail', args=(lyr.alternate,))) self.failUnlessEqual(response.status_code, 200) @@ -277,7 +288,13 @@ def test_layer_save(self): {"text": u"ä", "href": "a", "id": 10}, {"text": u"ö", "href": "o", "id": 7}, {"text": u"ü", "href": "u", "id": 8}, - {"text": u"論語", "href": "lun-yu", "id": 6} + {"text": u"論語", "href": "lun-yu", "id": 6}, + {"text": u"Europe<script>true;</script>", + "href": "u'europeltscriptgttrueltscriptgt", "id": 12}, + {"text": u"land_<script>true;</script>covering", + "href": "u'land_ltscriptgttrueltscriptgtcovering", "id": 13}, + {"text": u"<IMGSRC='javascript:true;'>Science", + "href": "u'ltimgsrc39javascripttrue39gtscience", "id": 11}, ])) def test_layer_links(self): diff --git a/geonode/services/templates/services/service_detail.html b/geonode/services/templates/services/service_detail.html index b2bf0d48e2b..4c60bbeefac 100644 --- a/geonode/services/templates/services/service_detail.html +++ b/geonode/services/templates/services/service_detail.html @@ -41,15 +41,15 @@

{% trans "Service Resources" %} {{ total_resources }} - {{service.title}} - {{service.abstract}} + {{service.title|striptags}} + {{service.abstract|striptags}} {% endfor %} {% for layer in layers %} {% if layer.group != "background" %} - {{layer.title}} - {{layer.abstract}} + {{layer.title|striptags}} + {{layer.abstract|striptags}} {% endif %} {% endfor %}