Prevent XML Denial of Service Attacks
This patch prevents entity expansion for provided XML content to guard against XML denial of service attacks like XML bomb or Billion laughs attack.
This commit is contained in:
Lars Kiesow
parent
9440ccaffe
commit
0eb12f9133
10 changed files with 180 additions and 180 deletions
|
|
@ -3,7 +3,7 @@
|
|||
feedgen.entry
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
:copyright: 2013, Lars Kiesow <lkiesow@uos.de>
|
||||
:copyright: 2013-2020, Lars Kiesow <lkiesow@uos.de>
|
||||
|
||||
:license: FreeBSD and LGPL, see license.* for more details.
|
||||
'''
|
||||
|
|
@ -13,10 +13,11 @@ from datetime import datetime
|
|||
import dateutil.parser
|
||||
import dateutil.tz
|
||||
import warnings
|
||||
from lxml import etree
|
||||
|
||||
from lxml.etree import CDATA # nosec - adding CDATA entry is safe
|
||||
|
||||
from feedgen.compat import string_types
|
||||
from feedgen.util import ensure_format, formatRFC2822
|
||||
from feedgen.util import ensure_format, formatRFC2822, xml_fromstring, xml_elem
|
||||
|
||||
|
||||
def _add_text_elm(entry, data, name):
|
||||
|
|
@ -24,7 +25,7 @@ def _add_text_elm(entry, data, name):
|
|||
if not data:
|
||||
return
|
||||
|
||||
elm = etree.SubElement(entry, name)
|
||||
elm = xml_elem(name, entry)
|
||||
type_ = data.get('type')
|
||||
if data.get('src'):
|
||||
if name != 'content':
|
||||
|
|
@ -34,16 +35,14 @@ def _add_text_elm(entry, data, name):
|
|||
elif data.get(name):
|
||||
# Surround xhtml with a div tag, parse it and embed it
|
||||
if type_ == 'xhtml':
|
||||
elm.append(etree.fromstring(
|
||||
'<div xmlns="http://www.w3.org/1999/xhtml">' +
|
||||
data.get(name) + '</div>'))
|
||||
xhtml = '<div xmlns="http://www.w3.org/1999/xhtml">' \
|
||||
+ data.get(name) + '</div>'
|
||||
elm.append(xml_fromstring(xhtml))
|
||||
elif type_ == 'CDATA':
|
||||
elm.text = etree.CDATA(
|
||||
data.get(name))
|
||||
elm.text = CDATA(data.get(name))
|
||||
# Parse XML and embed it
|
||||
elif type_ and (type_.endswith('/xml') or type_.endswith('+xml')):
|
||||
elm.append(etree.fromstring(
|
||||
data[name]))
|
||||
elm.append(xml_fromstring(data[name]))
|
||||
# Embed the text in escaped form
|
||||
elif not type_ or type_.startswith('text') or type_ == 'html':
|
||||
elm.text = data.get(name)
|
||||
|
|
@ -102,14 +101,14 @@ class FeedEntry(object):
|
|||
|
||||
def atom_entry(self, extensions=True):
|
||||
'''Create an ATOM entry and return it.'''
|
||||
entry = etree.Element('entry')
|
||||
entry = xml_elem('entry')
|
||||
if not (self.__atom_id and self.__atom_title and self.__atom_updated):
|
||||
raise ValueError('Required fields not set')
|
||||
id = etree.SubElement(entry, 'id')
|
||||
id = xml_elem('id', entry)
|
||||
id.text = self.__atom_id
|
||||
title = etree.SubElement(entry, 'title')
|
||||
title = xml_elem('title', entry)
|
||||
title.text = self.__atom_title
|
||||
updated = etree.SubElement(entry, 'updated')
|
||||
updated = xml_elem('updated', entry)
|
||||
updated.text = self.__atom_updated.isoformat()
|
||||
|
||||
# An entry must contain an alternate link if there is no content
|
||||
|
|
@ -125,20 +124,20 @@ class FeedEntry(object):
|
|||
# Atom requires a name. Skip elements without.
|
||||
if not a.get('name'):
|
||||
continue
|
||||
author = etree.SubElement(entry, 'author')
|
||||
name = etree.SubElement(author, 'name')
|
||||
author = xml_elem('author', entry)
|
||||
name = xml_elem('name', author)
|
||||
name.text = a.get('name')
|
||||
if a.get('email'):
|
||||
email = etree.SubElement(author, 'email')
|
||||
email = xml_elem('email', author)
|
||||
email.text = a.get('email')
|
||||
if a.get('uri'):
|
||||
uri = etree.SubElement(author, 'uri')
|
||||
uri = xml_elem('uri', author)
|
||||
uri.text = a.get('uri')
|
||||
|
||||
_add_text_elm(entry, self.__atom_content, 'content')
|
||||
|
||||
for l in self.__atom_link or []:
|
||||
link = etree.SubElement(entry, 'link', href=l['href'])
|
||||
link = xml_elem('link', entry, href=l['href'])
|
||||
if l.get('rel'):
|
||||
link.attrib['rel'] = l['rel']
|
||||
if l.get('type'):
|
||||
|
|
@ -153,7 +152,7 @@ class FeedEntry(object):
|
|||
_add_text_elm(entry, self.__atom_summary, 'summary')
|
||||
|
||||
for c in self.__atom_category or []:
|
||||
cat = etree.SubElement(entry, 'category', term=c['term'])
|
||||
cat = xml_elem('category', entry, term=c['term'])
|
||||
if c.get('scheme'):
|
||||
cat.attrib['scheme'] = c['scheme']
|
||||
if c.get('label'):
|
||||
|
|
@ -164,32 +163,31 @@ class FeedEntry(object):
|
|||
# Atom requires a name. Skip elements without.
|
||||
if not c.get('name'):
|
||||
continue
|
||||
contrib = etree.SubElement(entry, 'contributor')
|
||||
name = etree.SubElement(contrib, 'name')
|
||||
contrib = xml_elem('contributor', entry)
|
||||
name = xml_elem('name', contrib)
|
||||
name.text = c.get('name')
|
||||
if c.get('email'):
|
||||
email = etree.SubElement(contrib, 'email')
|
||||
email = xml_elem('email', contrib)
|
||||
email.text = c.get('email')
|
||||
if c.get('uri'):
|
||||
uri = etree.SubElement(contrib, 'uri')
|
||||
uri = xml_elem('uri', contrib)
|
||||
uri.text = c.get('uri')
|
||||
|
||||
if self.__atom_published:
|
||||
published = etree.SubElement(entry, 'published')
|
||||
published = xml_elem('published', entry)
|
||||
published.text = self.__atom_published.isoformat()
|
||||
|
||||
if self.__atom_rights:
|
||||
rights = etree.SubElement(entry, 'rights')
|
||||
rights = xml_elem('rights', entry)
|
||||
rights.text = self.__atom_rights
|
||||
|
||||
if self.__atom_source:
|
||||
source = etree.SubElement(entry, 'source')
|
||||
source = xml_elem('source', entry)
|
||||
if self.__atom_source.get('title'):
|
||||
source_title = etree.SubElement(source, 'title')
|
||||
source_title = xml_elem('title', source)
|
||||
source_title.text = self.__atom_source['title']
|
||||
if self.__atom_source.get('link'):
|
||||
etree.SubElement(source, 'link',
|
||||
href=self.__atom_source['link'])
|
||||
xml_elem('link', source, href=self.__atom_source['link'])
|
||||
|
||||
if extensions:
|
||||
for ext in self.__extensions.values() or []:
|
||||
|
|
@ -200,60 +198,59 @@ class FeedEntry(object):
|
|||
|
||||
def rss_entry(self, extensions=True):
|
||||
'''Create a RSS item and return it.'''
|
||||
entry = etree.Element('item')
|
||||
entry = xml_elem('item')
|
||||
if not (self.__rss_title or
|
||||
self.__rss_description or
|
||||
self.__rss_content):
|
||||
raise ValueError('Required fields not set')
|
||||
if self.__rss_title:
|
||||
title = etree.SubElement(entry, 'title')
|
||||
title = xml_elem('title', entry)
|
||||
title.text = self.__rss_title
|
||||
if self.__rss_link:
|
||||
link = etree.SubElement(entry, 'link')
|
||||
link = xml_elem('link', entry)
|
||||
link.text = self.__rss_link
|
||||
if self.__rss_description and self.__rss_content:
|
||||
description = etree.SubElement(entry, 'description')
|
||||
description = xml_elem('description', entry)
|
||||
description.text = self.__rss_description
|
||||
XMLNS_CONTENT = 'http://purl.org/rss/1.0/modules/content/'
|
||||
content = etree.SubElement(entry, '{%s}encoded' % XMLNS_CONTENT)
|
||||
content.text = etree.CDATA(self.__rss_content['content']) \
|
||||
content = xml_elem('{%s}encoded' % XMLNS_CONTENT, entry)
|
||||
content.text = CDATA(self.__rss_content['content']) \
|
||||
if self.__rss_content.get('type', '') == 'CDATA' \
|
||||
else self.__rss_content['content']
|
||||
elif self.__rss_description:
|
||||
description = etree.SubElement(entry, 'description')
|
||||
description = xml_elem('description', entry)
|
||||
description.text = self.__rss_description
|
||||
elif self.__rss_content:
|
||||
description = etree.SubElement(entry, 'description')
|
||||
description.text = etree.CDATA(self.__rss_content['content']) \
|
||||
description = xml_elem('description', entry)
|
||||
description.text = CDATA(self.__rss_content['content']) \
|
||||
if self.__rss_content.get('type', '') == 'CDATA' \
|
||||
else self.__rss_content['content']
|
||||
for a in self.__rss_author or []:
|
||||
author = etree.SubElement(entry, 'author')
|
||||
author = xml_elem('author', entry)
|
||||
author.text = a
|
||||
if self.__rss_guid.get('guid'):
|
||||
guid = etree.SubElement(entry, 'guid')
|
||||
guid = xml_elem('guid', entry)
|
||||
guid.text = self.__rss_guid['guid']
|
||||
permaLink = str(self.__rss_guid.get('permalink', False)).lower()
|
||||
guid.attrib['isPermaLink'] = permaLink
|
||||
for cat in self.__rss_category or []:
|
||||
category = etree.SubElement(entry, 'category')
|
||||
category = xml_elem('category', entry)
|
||||
category.text = cat['value']
|
||||
if cat.get('domain'):
|
||||
category.attrib['domain'] = cat['domain']
|
||||
if self.__rss_comments:
|
||||
comments = etree.SubElement(entry, 'comments')
|
||||
comments = xml_elem('comments', entry)
|
||||
comments.text = self.__rss_comments
|
||||
if self.__rss_enclosure:
|
||||
enclosure = etree.SubElement(entry, 'enclosure')
|
||||
enclosure = xml_elem('enclosure', entry)
|
||||
enclosure.attrib['url'] = self.__rss_enclosure['url']
|
||||
enclosure.attrib['length'] = self.__rss_enclosure['length']
|
||||
enclosure.attrib['type'] = self.__rss_enclosure['type']
|
||||
if self.__rss_pubDate:
|
||||
pubDate = etree.SubElement(entry, 'pubDate')
|
||||
pubDate = xml_elem('pubDate', entry)
|
||||
pubDate.text = formatRFC2822(self.__rss_pubDate)
|
||||
if self.__rss_source:
|
||||
source = etree.SubElement(entry, 'source',
|
||||
url=self.__rss_source['url'])
|
||||
source = xml_elem('source', entry, url=self.__rss_source['url'])
|
||||
source.text = self.__rss_source['title']
|
||||
|
||||
if extensions:
|
||||
|
|
|
|||
|
|
@ -13,9 +13,8 @@
|
|||
:license: FreeBSD and LGPL, see license.* for more details.
|
||||
'''
|
||||
|
||||
from lxml import etree
|
||||
|
||||
from feedgen.ext.base import BaseExtension
|
||||
from feedgen.util import xml_elem
|
||||
|
||||
|
||||
class DcBaseExtension(BaseExtension):
|
||||
|
|
@ -45,10 +44,10 @@ class DcBaseExtension(BaseExtension):
|
|||
def extend_ns(self):
|
||||
return {'dc': 'http://purl.org/dc/elements/1.1/'}
|
||||
|
||||
def _extend_xml(self, xml_elem):
|
||||
'''Extend xml_elem with set DC fields.
|
||||
def _extend_xml(self, xml_element):
|
||||
'''Extend xml_element with set DC fields.
|
||||
|
||||
:param xml_elem: etree element
|
||||
:param xml_element: etree element
|
||||
'''
|
||||
DCELEMENTS_NS = 'http://purl.org/dc/elements/1.1/'
|
||||
|
||||
|
|
@ -58,8 +57,8 @@ class DcBaseExtension(BaseExtension):
|
|||
'identifier']:
|
||||
if hasattr(self, '_dcelem_%s' % elem):
|
||||
for val in getattr(self, '_dcelem_%s' % elem) or []:
|
||||
node = etree.SubElement(xml_elem,
|
||||
'{%s}%s' % (DCELEMENTS_NS, elem))
|
||||
node = xml_elem('{%s}%s' % (DCELEMENTS_NS, elem),
|
||||
xml_element)
|
||||
node.text = val
|
||||
|
||||
def extend_atom(self, atom_feed):
|
||||
|
|
|
|||
|
|
@ -12,8 +12,8 @@
|
|||
import numbers
|
||||
import warnings
|
||||
|
||||
from lxml import etree
|
||||
from feedgen.ext.base import BaseEntryExtension
|
||||
from feedgen.util import xml_elem
|
||||
|
||||
|
||||
class GeoRSSPolygonInteriorWarning(Warning):
|
||||
|
|
@ -86,49 +86,43 @@ class GeoEntryExtension(BaseEntryExtension):
|
|||
GEO_NS = 'http://www.georss.org/georss'
|
||||
|
||||
if self.__point:
|
||||
point = etree.SubElement(entry, '{%s}point' % GEO_NS)
|
||||
point = xml_elem('{%s}point' % GEO_NS, entry)
|
||||
point.text = self.__point
|
||||
|
||||
if self.__line:
|
||||
line = etree.SubElement(entry, '{%s}line' % GEO_NS)
|
||||
line = xml_elem('{%s}line' % GEO_NS, entry)
|
||||
line.text = self.__line
|
||||
|
||||
if self.__polygon:
|
||||
polygon = etree.SubElement(entry, '{%s}polygon' % GEO_NS)
|
||||
polygon = xml_elem('{%s}polygon' % GEO_NS, entry)
|
||||
polygon.text = self.__polygon
|
||||
|
||||
if self.__box:
|
||||
box = etree.SubElement(entry, '{%s}box' % GEO_NS)
|
||||
box = xml_elem('{%s}box' % GEO_NS, entry)
|
||||
box.text = self.__box
|
||||
|
||||
if self.__featuretypetag:
|
||||
featuretypetag = etree.SubElement(
|
||||
entry,
|
||||
'{%s}featuretypetag' % GEO_NS
|
||||
)
|
||||
featuretypetag = xml_elem('{%s}featuretypetag' % GEO_NS, entry)
|
||||
featuretypetag.text = self.__featuretypetag
|
||||
|
||||
if self.__relationshiptag:
|
||||
relationshiptag = etree.SubElement(
|
||||
entry,
|
||||
'{%s}relationshiptag' % GEO_NS
|
||||
)
|
||||
relationshiptag = xml_elem('{%s}relationshiptag' % GEO_NS, entry)
|
||||
relationshiptag.text = self.__relationshiptag
|
||||
|
||||
if self.__featurename:
|
||||
featurename = etree.SubElement(entry, '{%s}featurename' % GEO_NS)
|
||||
featurename = xml_elem('{%s}featurename' % GEO_NS, entry)
|
||||
featurename.text = self.__featurename
|
||||
|
||||
if self.__elev:
|
||||
elevation = etree.SubElement(entry, '{%s}elev' % GEO_NS)
|
||||
elevation = xml_elem('{%s}elev' % GEO_NS, entry)
|
||||
elevation.text = str(self.__elev)
|
||||
|
||||
if self.__floor:
|
||||
floor = etree.SubElement(entry, '{%s}floor' % GEO_NS)
|
||||
floor = xml_elem('{%s}floor' % GEO_NS, entry)
|
||||
floor.text = str(self.__floor)
|
||||
|
||||
if self.__radius:
|
||||
radius = etree.SubElement(entry, '{%s}radius' % GEO_NS)
|
||||
radius = xml_elem('{%s}radius' % GEO_NS, entry)
|
||||
radius.text = str(self.__radius)
|
||||
|
||||
return entry
|
||||
|
|
|
|||
|
|
@ -10,10 +10,8 @@
|
|||
:license: FreeBSD and LGPL, see license.* for more details.
|
||||
'''
|
||||
|
||||
from lxml import etree
|
||||
|
||||
from feedgen.ext.base import BaseEntryExtension, BaseExtension
|
||||
from feedgen.util import ensure_format
|
||||
from feedgen.util import ensure_format, xml_elem
|
||||
|
||||
MEDIA_NS = 'http://search.yahoo.com/mrss/'
|
||||
|
||||
|
|
@ -45,10 +43,10 @@ class MediaEntryExtension(BaseEntryExtension):
|
|||
# Define current media:group
|
||||
group = groups.get(media_content.get('group'))
|
||||
if group is None:
|
||||
group = etree.SubElement(entry, '{%s}group' % MEDIA_NS)
|
||||
group = xml_elem('{%s}group' % MEDIA_NS, entry)
|
||||
groups[media_content.get('group')] = group
|
||||
# Add content
|
||||
content = etree.SubElement(group, '{%s}content' % MEDIA_NS)
|
||||
content = xml_elem('{%s}content' % MEDIA_NS, group)
|
||||
for attr in ('url', 'fileSize', 'type', 'medium', 'isDefault',
|
||||
'expression', 'bitrate', 'framerate', 'samplingrate',
|
||||
'channels', 'duration', 'height', 'width', 'lang'):
|
||||
|
|
@ -59,10 +57,10 @@ class MediaEntryExtension(BaseEntryExtension):
|
|||
# Define current media:group
|
||||
group = groups.get(media_thumbnail.get('group'))
|
||||
if group is None:
|
||||
group = etree.SubElement(entry, '{%s}group' % MEDIA_NS)
|
||||
group = xml_elem('{%s}group' % MEDIA_NS, entry)
|
||||
groups[media_thumbnail.get('group')] = group
|
||||
# Add thumbnails
|
||||
thumbnail = etree.SubElement(group, '{%s}thumbnail' % MEDIA_NS)
|
||||
thumbnail = xml_elem('{%s}thumbnail' % MEDIA_NS, group)
|
||||
for attr in ('url', 'height', 'width', 'time'):
|
||||
if media_thumbnail.get(attr):
|
||||
thumbnail.set(attr, media_thumbnail[attr])
|
||||
|
|
|
|||
|
|
@ -10,11 +10,9 @@
|
|||
:license: FreeBSD and LGPL, see license.* for more details.
|
||||
'''
|
||||
|
||||
from lxml import etree
|
||||
|
||||
from feedgen.compat import string_types
|
||||
from feedgen.ext.base import BaseExtension
|
||||
from feedgen.util import ensure_format
|
||||
from feedgen.util import ensure_format, xml_elem
|
||||
|
||||
|
||||
class PodcastExtension(BaseExtension):
|
||||
|
|
@ -47,11 +45,11 @@ class PodcastExtension(BaseExtension):
|
|||
channel = rss_feed[0]
|
||||
|
||||
if self.__itunes_author:
|
||||
author = etree.SubElement(channel, '{%s}author' % ITUNES_NS)
|
||||
author = xml_elem('{%s}author' % ITUNES_NS, channel)
|
||||
author.text = self.__itunes_author
|
||||
|
||||
if self.__itunes_block is not None:
|
||||
block = etree.SubElement(channel, '{%s}block' % ITUNES_NS)
|
||||
block = xml_elem('{%s}block' % ITUNES_NS, channel)
|
||||
block.text = 'yes' if self.__itunes_block else 'no'
|
||||
|
||||
for c in self.__itunes_category or []:
|
||||
|
|
@ -60,45 +58,42 @@ class PodcastExtension(BaseExtension):
|
|||
category = channel.find(
|
||||
'{%s}category[@text="%s"]' % (ITUNES_NS, c.get('cat')))
|
||||
if category is None:
|
||||
category = etree.SubElement(channel,
|
||||
'{%s}category' % ITUNES_NS)
|
||||
category = xml_elem('{%s}category' % ITUNES_NS, channel)
|
||||
category.attrib['text'] = c.get('cat')
|
||||
|
||||
if c.get('sub'):
|
||||
subcategory = etree.SubElement(category,
|
||||
'{%s}category' % ITUNES_NS)
|
||||
subcategory = xml_elem('{%s}category' % ITUNES_NS, category)
|
||||
subcategory.attrib['text'] = c.get('sub')
|
||||
|
||||
if self.__itunes_image:
|
||||
image = etree.SubElement(channel, '{%s}image' % ITUNES_NS)
|
||||
image = xml_elem('{%s}image' % ITUNES_NS, channel)
|
||||
image.attrib['href'] = self.__itunes_image
|
||||
|
||||
if self.__itunes_explicit in ('yes', 'no', 'clean'):
|
||||
explicit = etree.SubElement(channel, '{%s}explicit' % ITUNES_NS)
|
||||
explicit = xml_elem('{%s}explicit' % ITUNES_NS, channel)
|
||||
explicit.text = self.__itunes_explicit
|
||||
|
||||
if self.__itunes_complete in ('yes', 'no'):
|
||||
complete = etree.SubElement(channel, '{%s}complete' % ITUNES_NS)
|
||||
complete = xml_elem('{%s}complete' % ITUNES_NS, channel)
|
||||
complete.text = self.__itunes_complete
|
||||
|
||||
if self.__itunes_new_feed_url:
|
||||
new_feed_url = etree.SubElement(channel,
|
||||
'{%s}new-feed-url' % ITUNES_NS)
|
||||
new_feed_url = xml_elem('{%s}new-feed-url' % ITUNES_NS, channel)
|
||||
new_feed_url.text = self.__itunes_new_feed_url
|
||||
|
||||
if self.__itunes_owner:
|
||||
owner = etree.SubElement(channel, '{%s}owner' % ITUNES_NS)
|
||||
owner_name = etree.SubElement(owner, '{%s}name' % ITUNES_NS)
|
||||
owner = xml_elem('{%s}owner' % ITUNES_NS, channel)
|
||||
owner_name = xml_elem('{%s}name' % ITUNES_NS, owner)
|
||||
owner_name.text = self.__itunes_owner.get('name')
|
||||
owner_email = etree.SubElement(owner, '{%s}email' % ITUNES_NS)
|
||||
owner_email = xml_elem('{%s}email' % ITUNES_NS, owner)
|
||||
owner_email.text = self.__itunes_owner.get('email')
|
||||
|
||||
if self.__itunes_subtitle:
|
||||
subtitle = etree.SubElement(channel, '{%s}subtitle' % ITUNES_NS)
|
||||
subtitle = xml_elem('{%s}subtitle' % ITUNES_NS, channel)
|
||||
subtitle.text = self.__itunes_subtitle
|
||||
|
||||
if self.__itunes_summary:
|
||||
summary = etree.SubElement(channel, '{%s}summary' % ITUNES_NS)
|
||||
summary = xml_elem('{%s}summary' % ITUNES_NS, channel)
|
||||
summary.text = self.__itunes_summary
|
||||
|
||||
return rss_feed
|
||||
|
|
|
|||
|
|
@ -10,9 +10,8 @@
|
|||
:license: FreeBSD and LGPL, see license.* for more details.
|
||||
'''
|
||||
|
||||
from lxml import etree
|
||||
|
||||
from feedgen.ext.base import BaseEntryExtension
|
||||
from feedgen.util import xml_elem
|
||||
|
||||
|
||||
class PodcastEntryExtension(BaseEntryExtension):
|
||||
|
|
@ -40,43 +39,43 @@ class PodcastEntryExtension(BaseEntryExtension):
|
|||
ITUNES_NS = 'http://www.itunes.com/dtds/podcast-1.0.dtd'
|
||||
|
||||
if self.__itunes_author:
|
||||
author = etree.SubElement(entry, '{%s}author' % ITUNES_NS)
|
||||
author = xml_elem('{%s}author' % ITUNES_NS, entry)
|
||||
author.text = self.__itunes_author
|
||||
|
||||
if self.__itunes_block is not None:
|
||||
block = etree.SubElement(entry, '{%s}block' % ITUNES_NS)
|
||||
block = xml_elem('{%s}block' % ITUNES_NS, entry)
|
||||
block.text = 'yes' if self.__itunes_block else 'no'
|
||||
|
||||
if self.__itunes_image:
|
||||
image = etree.SubElement(entry, '{%s}image' % ITUNES_NS)
|
||||
image = xml_elem('{%s}image' % ITUNES_NS, entry)
|
||||
image.attrib['href'] = self.__itunes_image
|
||||
|
||||
if self.__itunes_duration:
|
||||
duration = etree.SubElement(entry, '{%s}duration' % ITUNES_NS)
|
||||
duration = xml_elem('{%s}duration' % ITUNES_NS, entry)
|
||||
duration.text = self.__itunes_duration
|
||||
|
||||
if self.__itunes_explicit in ('yes', 'no', 'clean'):
|
||||
explicit = etree.SubElement(entry, '{%s}explicit' % ITUNES_NS)
|
||||
explicit = xml_elem('{%s}explicit' % ITUNES_NS, entry)
|
||||
explicit.text = self.__itunes_explicit
|
||||
|
||||
if self.__itunes_is_closed_captioned is not None:
|
||||
is_closed_captioned = etree.SubElement(
|
||||
entry, '{%s}isClosedCaptioned' % ITUNES_NS)
|
||||
is_closed_captioned = xml_elem(
|
||||
'{%s}isClosedCaptioned' % ITUNES_NS, entry)
|
||||
if self.__itunes_is_closed_captioned:
|
||||
is_closed_captioned.text = 'yes'
|
||||
else:
|
||||
is_closed_captioned.text = 'no'
|
||||
|
||||
if self.__itunes_order is not None and self.__itunes_order >= 0:
|
||||
order = etree.SubElement(entry, '{%s}order' % ITUNES_NS)
|
||||
order = xml_elem('{%s}order' % ITUNES_NS, entry)
|
||||
order.text = str(self.__itunes_order)
|
||||
|
||||
if self.__itunes_subtitle:
|
||||
subtitle = etree.SubElement(entry, '{%s}subtitle' % ITUNES_NS)
|
||||
subtitle = xml_elem('{%s}subtitle' % ITUNES_NS, entry)
|
||||
subtitle.text = self.__itunes_subtitle
|
||||
|
||||
if self.__itunes_summary:
|
||||
summary = etree.SubElement(entry, '{%s}summary' % ITUNES_NS)
|
||||
summary = xml_elem('{%s}summary' % ITUNES_NS, entry)
|
||||
summary.text = self.__itunes_summary
|
||||
return entry
|
||||
|
||||
|
|
|
|||
|
|
@ -10,9 +10,8 @@ See below for details
|
|||
http://web.resource.org/rss/1.0/modules/syndication/
|
||||
'''
|
||||
|
||||
from lxml import etree
|
||||
|
||||
from feedgen.ext.base import BaseExtension
|
||||
from feedgen.util import xml_elem
|
||||
|
||||
SYNDICATION_NS = 'http://purl.org/rss/1.0/modules/syndication/'
|
||||
PERIOD_TYPE = ('hourly', 'daily', 'weekly', 'monthly', 'yearly')
|
||||
|
|
@ -20,7 +19,7 @@ PERIOD_TYPE = ('hourly', 'daily', 'weekly', 'monthly', 'yearly')
|
|||
|
||||
def _set_value(channel, name, value):
|
||||
if value:
|
||||
newelem = etree.SubElement(channel, '{%s}' % SYNDICATION_NS + name)
|
||||
newelem = xml_elem('{%s}' % SYNDICATION_NS + name, channel)
|
||||
newelem.text = value
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -10,9 +10,8 @@
|
|||
:license: FreeBSD and LGPL, see license.* for more details.
|
||||
'''
|
||||
|
||||
from lxml import etree
|
||||
|
||||
from feedgen.ext.base import BaseEntryExtension, BaseExtension
|
||||
from feedgen.util import xml_elem
|
||||
|
||||
TORRENT_NS = 'http://xmlns.ezrss.it/0.1/dtd/'
|
||||
|
||||
|
|
@ -41,30 +40,29 @@ class TorrentEntryExtension(BaseEntryExtension):
|
|||
:param feed: The RSS item XML element to use.
|
||||
'''
|
||||
if self.__torrent_filename:
|
||||
filename = etree.SubElement(entry, '{%s}filename' % TORRENT_NS)
|
||||
filename = xml_elem('{%s}filename' % TORRENT_NS, entry)
|
||||
filename.text = self.__torrent_filename
|
||||
|
||||
if self.__torrent_contentlength:
|
||||
contentlength = etree.SubElement(entry,
|
||||
'{%s}contentlength' % TORRENT_NS)
|
||||
contentlength = xml_elem('{%s}contentlength' % TORRENT_NS, entry)
|
||||
contentlength.text = self.__torrent_contentlength
|
||||
|
||||
if self.__torrent_infohash:
|
||||
infohash = etree.SubElement(entry, '{%s}infohash' % TORRENT_NS)
|
||||
infohash = xml_elem('{%s}infohash' % TORRENT_NS, entry)
|
||||
infohash.text = self.__torrent_infohash
|
||||
magnet = etree.SubElement(entry, '{%s}magneturi' % TORRENT_NS)
|
||||
magnet = xml_elem('{%s}magneturi' % TORRENT_NS, entry)
|
||||
magnet.text = 'magnet:?xt=urn:btih:' + self.__torrent_infohash
|
||||
|
||||
if self.__torrent_seeds:
|
||||
seeds = etree.SubElement(entry, '{%s}seed' % TORRENT_NS)
|
||||
seeds = xml_elem('{%s}seed' % TORRENT_NS, entry)
|
||||
seeds.text = self.__torrent_seeds
|
||||
|
||||
if self.__torrent_peers:
|
||||
peers = etree.SubElement(entry, '{%s}peers' % TORRENT_NS)
|
||||
peers = xml_elem('{%s}peers' % TORRENT_NS, entry)
|
||||
peers.text = self.__torrent_peers
|
||||
|
||||
if self.__torrent_verified:
|
||||
verified = etree.SubElement(entry, '{%s}verified' % TORRENT_NS)
|
||||
verified = xml_elem('{%s}verified' % TORRENT_NS, entry)
|
||||
verified.text = self.__torrent_verified
|
||||
|
||||
def filename(self, torrent_filename=None):
|
||||
|
|
|
|||
113
feedgen/feed.py
113
feedgen/feed.py
|
|
@ -3,7 +3,7 @@
|
|||
feedgen.feed
|
||||
~~~~~~~~~~~~
|
||||
|
||||
:copyright: 2013-2016, Lars Kiesow <lkiesow@uos.de>
|
||||
:copyright: 2013-2020, Lars Kiesow <lkiesow@uos.de>
|
||||
|
||||
:license: FreeBSD and LGPL, see license.* for more details.
|
||||
|
||||
|
|
@ -14,12 +14,12 @@ from datetime import datetime
|
|||
|
||||
import dateutil.parser
|
||||
import dateutil.tz
|
||||
from lxml import etree
|
||||
from lxml import etree # nosec - not using this for parsing
|
||||
|
||||
import feedgen.version
|
||||
from feedgen.compat import string_types
|
||||
from feedgen.entry import FeedEntry
|
||||
from feedgen.util import ensure_format, formatRFC2822
|
||||
from feedgen.util import ensure_format, formatRFC2822, xml_elem
|
||||
|
||||
_feedgen_version = feedgen.version.version_str
|
||||
|
||||
|
|
@ -47,7 +47,7 @@ class FeedGenerator(object):
|
|||
self.__atom_contributor = None
|
||||
self.__atom_generator = {
|
||||
'value': 'python-feedgen',
|
||||
'uri': 'http://lkiesow.github.io/python-feedgen',
|
||||
'uri': 'https://lkiesow.github.io/python-feedgen',
|
||||
'version': feedgen.version.version_str} # {value*,uri,version}
|
||||
self.__atom_icon = None
|
||||
self.__atom_logo = None
|
||||
|
|
@ -95,9 +95,9 @@ class FeedGenerator(object):
|
|||
if ext.get('atom'):
|
||||
nsmap.update(ext['inst'].extend_ns())
|
||||
|
||||
feed = etree.Element('feed',
|
||||
xmlns='http://www.w3.org/2005/Atom',
|
||||
nsmap=nsmap)
|
||||
feed = xml_elem('feed',
|
||||
xmlns='http://www.w3.org/2005/Atom',
|
||||
nsmap=nsmap)
|
||||
if self.__atom_feed_xml_lang:
|
||||
feed.attrib['{http://www.w3.org/XML/1998/namespace}lang'] = \
|
||||
self.__atom_feed_xml_lang
|
||||
|
|
@ -108,11 +108,11 @@ class FeedGenerator(object):
|
|||
([] if self.__atom_updated else ['updated'])
|
||||
missing = ', '.join(missing)
|
||||
raise ValueError('Required fields not set (%s)' % missing)
|
||||
id = etree.SubElement(feed, 'id')
|
||||
id = xml_elem('id', feed)
|
||||
id.text = self.__atom_id
|
||||
title = etree.SubElement(feed, 'title')
|
||||
title = xml_elem('title', feed)
|
||||
title.text = self.__atom_title
|
||||
updated = etree.SubElement(feed, 'updated')
|
||||
updated = xml_elem('updated', feed)
|
||||
updated.text = self.__atom_updated.isoformat()
|
||||
|
||||
# Add author elements
|
||||
|
|
@ -120,18 +120,18 @@ class FeedGenerator(object):
|
|||
# Atom requires a name. Skip elements without.
|
||||
if not a.get('name'):
|
||||
continue
|
||||
author = etree.SubElement(feed, 'author')
|
||||
name = etree.SubElement(author, 'name')
|
||||
author = xml_elem('author', feed)
|
||||
name = xml_elem('name', author)
|
||||
name.text = a.get('name')
|
||||
if a.get('email'):
|
||||
email = etree.SubElement(author, 'email')
|
||||
email = xml_elem('email', author)
|
||||
email.text = a.get('email')
|
||||
if a.get('uri'):
|
||||
uri = etree.SubElement(author, 'uri')
|
||||
uri = xml_elem('uri', author)
|
||||
uri.text = a.get('uri')
|
||||
|
||||
for l in self.__atom_link or []:
|
||||
link = etree.SubElement(feed, 'link', href=l['href'])
|
||||
link = xml_elem('link', feed, href=l['href'])
|
||||
if l.get('rel'):
|
||||
link.attrib['rel'] = l['rel']
|
||||
if l.get('type'):
|
||||
|
|
@ -144,7 +144,7 @@ class FeedGenerator(object):
|
|||
link.attrib['length'] = l['length']
|
||||
|
||||
for c in self.__atom_category or []:
|
||||
cat = etree.SubElement(feed, 'category', term=c['term'])
|
||||
cat = xml_elem('category', feed, term=c['term'])
|
||||
if c.get('scheme'):
|
||||
cat.attrib['scheme'] = c['scheme']
|
||||
if c.get('label'):
|
||||
|
|
@ -155,18 +155,18 @@ class FeedGenerator(object):
|
|||
# Atom requires a name. Skip elements without.
|
||||
if not c.get('name'):
|
||||
continue
|
||||
contrib = etree.SubElement(feed, 'contributor')
|
||||
name = etree.SubElement(contrib, 'name')
|
||||
contrib = xml_elem('contributor', feed)
|
||||
name = xml_elem('name', contrib)
|
||||
name.text = c.get('name')
|
||||
if c.get('email'):
|
||||
email = etree.SubElement(contrib, 'email')
|
||||
email = xml_elem('email', contrib)
|
||||
email.text = c.get('email')
|
||||
if c.get('uri'):
|
||||
uri = etree.SubElement(contrib, 'uri')
|
||||
uri = xml_elem('uri', contrib)
|
||||
uri.text = c.get('uri')
|
||||
|
||||
if self.__atom_generator and self.__atom_generator.get('value'):
|
||||
generator = etree.SubElement(feed, 'generator')
|
||||
generator = xml_elem('generator', feed)
|
||||
generator.text = self.__atom_generator['value']
|
||||
if self.__atom_generator.get('uri'):
|
||||
generator.attrib['uri'] = self.__atom_generator['uri']
|
||||
|
|
@ -174,19 +174,19 @@ class FeedGenerator(object):
|
|||
generator.attrib['version'] = self.__atom_generator['version']
|
||||
|
||||
if self.__atom_icon:
|
||||
icon = etree.SubElement(feed, 'icon')
|
||||
icon = xml_elem('icon', feed)
|
||||
icon.text = self.__atom_icon
|
||||
|
||||
if self.__atom_logo:
|
||||
logo = etree.SubElement(feed, 'logo')
|
||||
logo = xml_elem('logo', feed)
|
||||
logo.text = self.__atom_logo
|
||||
|
||||
if self.__atom_rights:
|
||||
rights = etree.SubElement(feed, 'rights')
|
||||
rights = xml_elem('rights', feed)
|
||||
rights.text = self.__atom_rights
|
||||
|
||||
if self.__atom_subtitle:
|
||||
subtitle = etree.SubElement(feed, 'subtitle')
|
||||
subtitle = xml_elem('subtitle', feed)
|
||||
subtitle.text = self.__atom_subtitle
|
||||
|
||||
if extensions:
|
||||
|
|
@ -255,8 +255,8 @@ class FeedGenerator(object):
|
|||
nsmap.update({'atom': 'http://www.w3.org/2005/Atom',
|
||||
'content': 'http://purl.org/rss/1.0/modules/content/'})
|
||||
|
||||
feed = etree.Element('rss', version='2.0', nsmap=nsmap)
|
||||
channel = etree.SubElement(feed, 'channel')
|
||||
feed = xml_elem('rss', version='2.0', nsmap=nsmap)
|
||||
channel = xml_elem('channel', feed)
|
||||
if not (self.__rss_title and
|
||||
self.__rss_link and
|
||||
self.__rss_description):
|
||||
|
|
@ -265,18 +265,17 @@ class FeedGenerator(object):
|
|||
([] if self.__rss_description else ['description'])
|
||||
missing = ', '.join(missing)
|
||||
raise ValueError('Required fields not set (%s)' % missing)
|
||||
title = etree.SubElement(channel, 'title')
|
||||
title = xml_elem('title', channel)
|
||||
title.text = self.__rss_title
|
||||
link = etree.SubElement(channel, 'link')
|
||||
link = xml_elem('link', channel)
|
||||
link.text = self.__rss_link
|
||||
desc = etree.SubElement(channel, 'description')
|
||||
desc = xml_elem('description', channel)
|
||||
desc.text = self.__rss_description
|
||||
for ln in self.__atom_link or []:
|
||||
# It is recommended to include a atom self link in rss documents…
|
||||
if ln.get('rel') == 'self':
|
||||
selflink = etree.SubElement(
|
||||
channel, '{http://www.w3.org/2005/Atom}link',
|
||||
href=ln['href'], rel='self')
|
||||
selflink = xml_elem('{http://www.w3.org/2005/Atom}link',
|
||||
channel, href=ln['href'], rel='self')
|
||||
if ln.get('type'):
|
||||
selflink.attrib['type'] = ln['type']
|
||||
if ln.get('hreflang'):
|
||||
|
|
@ -288,12 +287,12 @@ class FeedGenerator(object):
|
|||
break
|
||||
if self.__rss_category:
|
||||
for cat in self.__rss_category:
|
||||
category = etree.SubElement(channel, 'category')
|
||||
category = xml_elem('category', channel)
|
||||
category.text = cat['value']
|
||||
if cat.get('domain'):
|
||||
category.attrib['domain'] = cat['domain']
|
||||
if self.__rss_cloud:
|
||||
cloud = etree.SubElement(channel, 'cloud')
|
||||
cloud = xml_elem('cloud', channel)
|
||||
cloud.attrib['domain'] = self.__rss_cloud.get('domain')
|
||||
cloud.attrib['port'] = self.__rss_cloud.get('port')
|
||||
cloud.attrib['path'] = self.__rss_cloud.get('path')
|
||||
|
|
@ -301,69 +300,69 @@ class FeedGenerator(object):
|
|||
'registerProcedure')
|
||||
cloud.attrib['protocol'] = self.__rss_cloud.get('protocol')
|
||||
if self.__rss_copyright:
|
||||
copyright = etree.SubElement(channel, 'copyright')
|
||||
copyright = xml_elem('copyright', channel)
|
||||
copyright.text = self.__rss_copyright
|
||||
if self.__rss_docs:
|
||||
docs = etree.SubElement(channel, 'docs')
|
||||
docs = xml_elem('docs', channel)
|
||||
docs.text = self.__rss_docs
|
||||
if self.__rss_generator:
|
||||
generator = etree.SubElement(channel, 'generator')
|
||||
generator = xml_elem('generator', channel)
|
||||
generator.text = self.__rss_generator
|
||||
if self.__rss_image:
|
||||
image = etree.SubElement(channel, 'image')
|
||||
url = etree.SubElement(image, 'url')
|
||||
image = xml_elem('image', channel)
|
||||
url = xml_elem('url', image)
|
||||
url.text = self.__rss_image.get('url')
|
||||
title = etree.SubElement(image, 'title')
|
||||
title = xml_elem('title', image)
|
||||
title.text = self.__rss_image.get('title', self.__rss_title)
|
||||
link = etree.SubElement(image, 'link')
|
||||
link = xml_elem('link', image)
|
||||
link.text = self.__rss_image.get('link', self.__rss_link)
|
||||
if self.__rss_image.get('width'):
|
||||
width = etree.SubElement(image, 'width')
|
||||
width = xml_elem('width', image)
|
||||
width.text = self.__rss_image.get('width')
|
||||
if self.__rss_image.get('height'):
|
||||
height = etree.SubElement(image, 'height')
|
||||
height = xml_elem('height', image)
|
||||
height.text = self.__rss_image.get('height')
|
||||
if self.__rss_image.get('description'):
|
||||
description = etree.SubElement(image, 'description')
|
||||
description = xml_elem('description', image)
|
||||
description.text = self.__rss_image.get('description')
|
||||
if self.__rss_language:
|
||||
language = etree.SubElement(channel, 'language')
|
||||
language = xml_elem('language', channel)
|
||||
language.text = self.__rss_language
|
||||
if self.__rss_lastBuildDate:
|
||||
lastBuildDate = etree.SubElement(channel, 'lastBuildDate')
|
||||
lastBuildDate = xml_elem('lastBuildDate', channel)
|
||||
|
||||
lastBuildDate.text = formatRFC2822(self.__rss_lastBuildDate)
|
||||
if self.__rss_managingEditor:
|
||||
managingEditor = etree.SubElement(channel, 'managingEditor')
|
||||
managingEditor = xml_elem('managingEditor', channel)
|
||||
managingEditor.text = self.__rss_managingEditor
|
||||
if self.__rss_pubDate:
|
||||
pubDate = etree.SubElement(channel, 'pubDate')
|
||||
pubDate = xml_elem('pubDate', channel)
|
||||
pubDate.text = formatRFC2822(self.__rss_pubDate)
|
||||
if self.__rss_rating:
|
||||
rating = etree.SubElement(channel, 'rating')
|
||||
rating = xml_elem('rating', channel)
|
||||
rating.text = self.__rss_rating
|
||||
if self.__rss_skipHours:
|
||||
skipHours = etree.SubElement(channel, 'skipHours')
|
||||
skipHours = xml_elem('skipHours', channel)
|
||||
for h in self.__rss_skipHours:
|
||||
hour = etree.SubElement(skipHours, 'hour')
|
||||
hour = xml_elem('hour', skipHours)
|
||||
hour.text = str(h)
|
||||
if self.__rss_skipDays:
|
||||
skipDays = etree.SubElement(channel, 'skipDays')
|
||||
skipDays = xml_elem('skipDays', channel)
|
||||
for d in self.__rss_skipDays:
|
||||
day = etree.SubElement(skipDays, 'day')
|
||||
day = xml_elem('day', skipDays)
|
||||
day.text = d
|
||||
if self.__rss_textInput:
|
||||
textInput = etree.SubElement(channel, 'textInput')
|
||||
textInput = xml_elem('textInput', channel)
|
||||
textInput.attrib['title'] = self.__rss_textInput.get('title')
|
||||
textInput.attrib['description'] = \
|
||||
self.__rss_textInput.get('description')
|
||||
textInput.attrib['name'] = self.__rss_textInput.get('name')
|
||||
textInput.attrib['link'] = self.__rss_textInput.get('link')
|
||||
if self.__rss_ttl:
|
||||
ttl = etree.SubElement(channel, 'ttl')
|
||||
ttl = xml_elem('ttl', channel)
|
||||
ttl.text = str(self.__rss_ttl)
|
||||
if self.__rss_webMaster:
|
||||
webMaster = etree.SubElement(channel, 'webMaster')
|
||||
webMaster = xml_elem('webMaster', channel)
|
||||
webMaster.text = self.__rss_webMaster
|
||||
|
||||
if extensions:
|
||||
|
|
|
|||
|
|
@ -10,6 +10,28 @@
|
|||
'''
|
||||
import locale
|
||||
import sys
|
||||
import lxml # nosec - we configure a safe parser below
|
||||
|
||||
# Configure a safe parser which does not allow XML entity expansion
|
||||
parser = lxml.etree.XMLParser(
|
||||
attribute_defaults=False,
|
||||
dtd_validation=False,
|
||||
load_dtd=False,
|
||||
no_network=True,
|
||||
recover=False,
|
||||
remove_pis=True,
|
||||
resolve_entities=False,
|
||||
huge_tree=False)
|
||||
|
||||
|
||||
def xml_fromstring(xmlstring):
|
||||
return lxml.etree.fromstring(xmlstring, parser) # nosec - safe parser
|
||||
|
||||
|
||||
def xml_elem(name, parent=None, **kwargs):
|
||||
if parent is not None:
|
||||
return lxml.etree.SubElement(parent, name, **kwargs)
|
||||
return lxml.etree.Element(name, **kwargs)
|
||||
|
||||
|
||||
def ensure_format(val, allowed, required, allowed_values=None, defaults=None):
|
||||
|
|
|
|||
Loading…
Reference in a new issue