bvandeusenandClaude Opus 5.5
0c66c1e7d3
Confirm dialog (#5314): - Every data-confirm form now asks in one native <dialog> (base.html + static/confirm.js) instead of window.confirm. - The question becomes the heading and what follows it the detail; the act's button is named after the form's own button; Cancel has the focus and Esc backs out. Optional data-confirm-title/-detail/-action/-dismiss attributes. - All 27 existing uses work as they are. Cancelling a run says 'Keep running'. Alerts list (#5315): - A verdict line (what is firing, how many rules, where notifications go, or 'notifies nobody yet' with a link) replaces the empty Active card. - Each rule's name opens it; rows show 'last fired' and fold fire/clear into the condition; History and Disable stay; Delete leaves the list. - .docker-verdict becomes the shared .page-verdict. Rule page (#5317): - Named for the rule (title and crumb), with when it last fired and how many changes of state it holds. - Three sections: what it watches, when it fires (checks side by side, seconds echoed as a duration), what happens (where notifications go, no-data, the playbook, whose fields stay folded until ticked). - Delete at the foot, behind the dialog, saying its history goes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
2.5 KiB
Python
52 lines
2.5 KiB
Python
"""No template puts a rendered value into inline JavaScript (#5099).
|
|
|
|
An onclick/onsubmit attribute is HTML-decoded before its JavaScript is
|
|
parsed, so autoescaping does not protect a name placed inside it: a monitor
|
|
called x');fetch(…);// ran as script when an admin clicked Delete. A
|
|
prompt goes in data-confirm="…" (base.html asks with it); any other value a
|
|
handler needs is an integer, rendered with |int.
|
|
"""
|
|
import re
|
|
|
|
from tests._templates import REPO as _REPO, template_files as _templates
|
|
|
|
_HANDLER = re.compile(r"""\bon[a-z]+\s*=\s*("[^"]*"|'[^']*')""", re.I)
|
|
_VALUE = re.compile(r"\{\{(.*?)\}\}", re.S)
|
|
|
|
|
|
def unsafe_handler_values(text: str) -> list[str]:
|
|
"""Each {{ … }} inside an inline handler that is not an |int."""
|
|
return [m.group(0) for h in _HANDLER.finditer(text) for m in _VALUE.finditer(h.group(1))
|
|
if not re.search(r"\|\s*int\s*$", m.group(1).strip())]
|
|
|
|
|
|
def test_the_guard_can_fail():
|
|
page = """
|
|
<button onclick="return confirm('Delete rule {{ rule.name }}?')">x</button>
|
|
<form onsubmit='return confirm({{ msg|tojson }})'>
|
|
<button onclick="toggle({{ idx|int }})">ok</button>
|
|
<button data-confirm="Delete {{ rule.name }}?" data-range="{{ key }}">ok</button>
|
|
"""
|
|
assert unsafe_handler_values(page) == ["{{ rule.name }}", "{{ msg|tojson }}"]
|
|
|
|
|
|
def test_no_template_renders_a_value_into_an_inline_handler():
|
|
files = _templates()
|
|
assert len(files) > 100
|
|
found = {str(p.relative_to(_REPO)): hits for p in files if (hits := unsafe_handler_values(p.read_text()))}
|
|
assert not found, f"use data-confirm, or render an integer with |int: {found}"
|
|
|
|
|
|
def test_base_asks_before_a_data_confirm_form_submits():
|
|
"""#5314: in Steward's own dialog, filled as text, never the browser's confirm()."""
|
|
base = (_REPO / "steward" / "templates" / "base.html").read_text()
|
|
js = (_REPO / "steward" / "static" / "confirm.js").read_text()
|
|
assert "filename='confirm.js'" in base and '<dialog id="confirm-dialog"' in base
|
|
assert '<form method="dialog">' in base
|
|
assert re.search(r'<button type="submit"[^>]*value="back"[^>]*autofocus>', base) # Cancel has the focus
|
|
assert re.search(r'<button type="submit"[^>]*btn-danger[^>]*value="go"', base)
|
|
assert "dataset.confirm" in js and "getElementById('confirm-dialog')" in js and "requestSubmit" in js
|
|
assert "textContent = title" in js and "innerHTML" not in js # text, never markup
|
|
assert "window.confirm" not in js and "window.confirm" not in base
|
|
assert any("data-confirm=" in p.read_text() for p in _templates())
|