[Fixes #5137][Fixes #5138] Encode Hierarchical tags and external service

geonode/base/models.py

@@ -41,6 +41,7 @@
 from django.core.files.base import ContentFile
 from django.contrib.gis.geos import GEOSGeometry
 from django.utils.timezone import now
+from django.utils.html import escape
 
 from mptt.models import MPTTModel, TreeForeignKey
 
@@ -383,6 +384,7 @@ def add(self, *tags):
         tag_objs.update(existing)
         for new_tag in str_tags - set(t.name for t in existing):
             if new_tag:
+                new_tag = escape(new_tag)
                 tag_objs.add(HierarchicalKeyword.add_root(name=new_tag))
 
         for tag in tag_objs:

geonode/layers/tests.py

@@ -258,6 +258,17 @@ def test_layer_save(self):
                 u'here', u'keywords', u'populartag', u'saving',
                 u'ß', u'ä', u'ö', u'ü', u'論語'])
 
+        # Test input escape
+        lyr.keywords.add(*["Europe<script>true;</script>",
+                           "land_<script>true;</script>covering",
+                           "<IMG SRC='javascript:true;'>Science"])
+
+        self.assertEqual(
+            lyr.keyword_list(), [
+                u'&lt;IMG SRC=&#39;javascript:true;&#39;&gt;Science', u'Europe&lt;script&gt;true;&lt;/script&gt;',
+                u'here', u'keywords', u'land_&lt;script&gt;true;&lt;/script&gt;covering', u'populartag', u'saving',
+                u'ß', u'ä', u'ö', u'ü', u'論語'])
+
         self.client.login(username='admin', password='admin')
         response = self.client.get(reverse('layer_detail', args=(lyr.alternate,)))
         self.failUnlessEqual(response.status_code, 200)
@@ -277,7 +288,13 @@ def test_layer_save(self):
             {"text": u"ä", "href": "a", "id": 10},
             {"text": u"ö", "href": "o", "id": 7},
             {"text": u"ü", "href": "u", "id": 8},
-            {"text": u"論語", "href": "lun-yu", "id": 6}
+            {"text": u"論語", "href": "lun-yu", "id": 6},
+            {"text": u"Europe&lt;script&gt;true;&lt;/script&gt;",
+                "href": "u'europeltscriptgttrueltscriptgt", "id": 12},
+            {"text": u"land_&lt;script&gt;true;&lt;/script&gt;covering",
+                "href": "u'land_ltscriptgttrueltscriptgtcovering", "id": 13},
+            {"text": u"&lt;IMGSRC=&#39;javascript:true;&#39;&gt;Science",
+                "href": "u'ltimgsrc39javascripttrue39gtscience", "id": 11},
         ]))
 
     def test_layer_links(self):

geonode/services/templates/services/service_detail.html

@@ -41,15 +41,15 @@ <h3>{% trans "Service Resources" %} <span class="badge">{{ total_resources }}</s
                 {% endfor %}
                 {% for service in services %}
                     <tr>
-                        <td><a href='{%  url "service_detail" service.id %}'>{{service.title}}</a></td>
-                        <td>{{service.abstract}}</td>
+                        <td><a href='{%  url "service_detail" service.id %}'>{{service.title|striptags}}</a></td>
+                        <td>{{service.abstract|striptags}}</td>
                     </tr>
                 {% endfor %}
                 {% for layer in layers %}
                     {% if layer.group != "background" %}
                         <tr>
-                            <td><a href='{{ layer.get_absolute_url }}'>{{layer.title}}</a></td>
-                            <td>{{layer.abstract}}</td>
+                            <td><a href='{{ layer.get_absolute_url }}'>{{layer.title|striptags}}</a></td>
+                            <td>{{layer.abstract|striptags}}</td>
                         </tr>
                     {% endif %}
                 {% endfor %}