Secure testing commits - Oct 2005 - r2490 - lib/python

Author: fw
Date: 2005-10-20 09:04:01 +0000 (Thu, 20 Oct 2005)
New Revision: 2490

Modified:
   lib/python/web_support.py
Log:
 r772@deneb:  fw | 2005-10-20 10:41:31 +0200
 lib/python/web_support.py (URLFactory.updateParams):
   New method.
 (charToHTML, charToHTMLattr):
   Replaces stringToHTML.

Modified: lib/python/web_support.py
==================================================================---
lib/python/web_support.py	2005-10-20 09:03:51 UTC (rev 2489)
+++ lib/python/web_support.py	2005-10-20 09:04:01 UTC (rev 2490)
@@ -144,13 +144,16 @@
     This factory class handles the case where a script wants to
     generate URLs which reference to itself (see
scriptRelative)."""
     
-    def __init__(self, server_name, script_name):
+    def __init__(self, server_name, script_name,
path_info='''',
+                 params={}):
         self.server_name = server_name or ''localhost''
         script_name = self._stripSlashes(script_name or '''')
         if script_name[-1:] == ''/'' or script_name ==
'''':
             self.script_name = script_name
         else:
             self.script_name = script_name + ''/''
+        self.path_info = self._stripSlashes(path_info)
+        self.params = params
 
     def _convertArgs(self, args):
         arglist = []
@@ -189,15 +192,26 @@
                                          self._stripSlashes(path),
                                          self._convertArgs(args)))
 
+    def updateParams(self, **args):
+        new_args = {}
+        for (key, value) in self.params.items():
+            new_args[key] = value
+        for (key, value) in args.items():
+            new_args[key] = value
+        return URL("/%s%s%s" % (self.script_name, self.path_info,
+                                self._convertArgs(new_args)))
 
-stringToHTML = map(chr, range(256))
+
+charToHTML = map(chr, range(256))
+charToHTMLattr = map(chr, range(256))
 def _initStringToHTML(s):
     for (ch, repl) in ((''<'',
''&lt;''),
                        (''>'',
''&gt;''),
-                       (''&'',
''&amp;''),
-                       (''"'',
''&quot;'')):
+                       (''&'',
''&amp;'')):
         s[ord(ch)] = repl
-_initStringToHTML(stringToHTML)
+_initStringToHTML(charToHTML)
+_initStringToHTML(charToHTMLattr)
+charToHTMLattr[ord(''"'')] = ''&34;''
 del _initStringToHTML
 
 def escapeHTML(str):
@@ -207,7 +221,7 @@
     result = []
     append = result.append
     for ch in str:
-        append(stringToHTML[ord(ch)])
+        append(charToHTML[ord(ch)])
     return ''''.join(result)
 
 class HTMLBase:
@@ -277,7 +291,7 @@
                 append(key)
             append(''="'')
             for ch in str(value):
-                append(stringToHTML[ord(ch)])
+                append(charToHTMLattr[ord(ch)])
             append(''"'')
         self.__attribs = ''''.join(attrs)
         self.contents = contents
@@ -624,7 +638,7 @@
             self.__writeError(result, 404, "page not found")
             return
         self.pre_dispatch()
-        url = URLFactory(server_name, script_name)
+        url = URLFactory(server_name, script_name, path, params)
         r = method(remaining, params, url)
         assert isinstance(r, Result), `r`
         r.flatten(result.write)
@@ -653,7 +667,7 @@
     assert P("").toString() ==
''<p></p>''
     assert P(" ").toString() == ''<p>
</p>''
     assert P("&").toString() ==
''<p>&amp;</p>''
-    assert P("\"").toString() ==
''<p>&quot;</p>''
+    assert P("\"").toString() ==
''<p>"</p>''
     assert P("<").toString() ==
''<p>&lt;</p>''
     assert P(">").toString() ==
''<p>&gt;</p>''
     assert P(">").toHTML().toString() ==
''<p>&gt;</p>''