-
Notifications
You must be signed in to change notification settings - Fork 1
fix lint #3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
fix lint #3
Changes from 19 commits
e74c2f3
2b54dcf
43809a1
65a6d0b
d4b161a
08b98c5
52d3671
6356db6
22cb5ac
5898dd0
225a775
877692c
5f13d49
bae6b88
4c917ea
c66cf9d
7ed34e7
7edbf27
10f6fd8
eaa3f2d
d2a4359
8a934c9
93e5c56
910140a
c061f9e
3b4a6c7
4a3c908
32ab65d
4991288
9b5893b
8e4efaa
56247d6
2f79ff4
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,17 +1,24 @@ | ||
| from flask import Flask, Response | ||
| from flask import Response | ||
| from typing import Any, Dict | ||
|
|
||
| def process(app, plugin_config: Dict[str, Any]): # Defines the main `process` function taking a Flask app instance and plugin configuration | ||
|
|
||
| def process( | ||
| app, plugin_config: Dict[str, Any] | ||
| ): # Defines the main `process` function taking a Flask app instance and plugin configuration | ||
| # Store plugin configuration (defaults to empty dict) | ||
| app.config['b4uleave'] = plugin_config or {} | ||
| app.config["b4uleave"] = plugin_config or {} | ||
|
|
||
| message = app.config['b4uleave'].get('message', 'Czy na pewno chcesz<br>opuścić naszą stronę?') | ||
| stay = app.config['b4uleave'].get('stay', 'Stay') | ||
| leave = app.config['b4uleave'].get('leave', 'Leave') | ||
| message = app.config["b4uleave"].get( | ||
| "message", "Czy na pewno chcesz<br>opuścić naszą stronę?" | ||
| ) | ||
| stay = app.config["b4uleave"].get("stay", "Stay") | ||
| leave = app.config["b4uleave"].get("leave", "Leave") | ||
|
|
||
| @app.after_request # Decorator that registers a function to run after each request is processed | ||
| @app.after_request # Decorator that registers a function to run after each request is processed | ||
| def add_B4ULeave(response: Response) -> Response: | ||
| if 'text/html' in response.headers.get('Content-Type', ''): # Function receives a Response object and returns a modified Response | ||
| if "text/html" in response.headers.get( | ||
| "Content-Type", "" | ||
| ): # Function receives a Response object and returns a modified Response | ||
| html = f""" | ||
| <style> | ||
| #B4ULeave-ModalWindow {{ | ||
|
|
@@ -103,8 +110,10 @@ def add_B4ULeave(response: Response) -> Response: | |
| }}); | ||
| }})(); | ||
| </script>""" | ||
| response.set_data(response.get_data(as_text=True).replace('</body>', html + '</body>')) | ||
| return response | ||
|
|
||
| response.set_data( | ||
| response.get_data(as_text=True).replace("</body>", html + "</body>") | ||
| ) | ||
|
Comment on lines
+115
to
+116
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion
Consider from bs4 import BeautifulSoup
soup = BeautifulSoup(response.get_data(as_text=True), "html.parser")
if soup.body:
soup.body.append(BeautifulSoup(html, "html.parser"))
response.set_data(str(soup))At minimum, perform a case-insensitive search and fall back gracefully. 🤖 Prompt for AI Agents |
||
| return response | ||
|
|
||
| return app | ||
| return app | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Unsanitised user-controlled HTML ⇒ reflected-XSS vector.
message,stay, andleavecome straight fromplugin_configand are interpolated into the DOM without escaping.An attacker configuring the plugin (or compromising the config source) can inject arbitrary scripts.
If you intentionally allow HTML in
message, useflask.Markupto whitelist only that field and still escape the others.Also applies to: 69-73
🤖 Prompt for AI Agents