backup/pywb
1
0
Fork 0
mirror of https://github.com/webrecorder/pywb.git synced 2025-03-24 06:59:52 +01:00
Code Issues Projects Releases Activity

html_rewriter: added the nullification of meta tag delivered CSP policies to HTMLRewriterMixin, treat it like the integrity attribute (#274)

Browse Source 
rewrite test: updated the html_rewriter test to cover the changes made for meta CSP rewriting
fixes #273
This commit is contained in:
John Berlin 2018-01-08 16:57:09 -05:00 committed by Ilya Kreymer
parent d3b379e788
commit 3c05f27829
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pywb/rewrite/html_rewriter.py
View File

@ -333,6 +333,8 @@ class HTMLRewriterMixin(StreamingRewriter):
elif (tag == 'meta') and (attr_name == 'content'): elif (tag == 'meta') and (attr_name == 'content'):
if self.has_attr(tag_attrs, ('http-equiv', 'refresh')): if self.has_attr(tag_attrs, ('http-equiv', 'refresh')):
attr_value = self._rewrite_meta_refresh(attr_value) attr_value = self._rewrite_meta_refresh(attr_value)
elif self.has_attr(tag_attrs, ('http-equiv', 'content-security-policy')):
attr_name = '_' + attr_name
elif self.has_attr(tag_attrs, ('name', 'referrer')): elif self.has_attr(tag_attrs, ('name', 'referrer')):
attr_value = 'no-referrer-when-downgrade' attr_value = 'no-referrer-when-downgrade'
elif attr_value.startswith(self.DATA_RW_PROTOCOLS): elif attr_value.startswith(self.DATA_RW_PROTOCOLS):

3
pywb/rewrite/test/test_html_rewriter.py
View File

@ -129,6 +129,9 @@ r"""
>>> parse('<meta name="referrer" content="origin">') >>> parse('<meta name="referrer" content="origin">')
<meta name="referrer" content="no-referrer-when-downgrade"> <meta name="referrer" content="no-referrer-when-downgrade">
>>> parse('<meta http-equiv="Content-Security-Policy" content="default-src http://example.com" />')
<meta http-equiv="Content-Security-Policy" _content="default-src http://example.com"/>
# Custom -data attribs # Custom -data attribs
>>> parse('<div data-url="http://example.com/a/b/c.html" data-some-other-value="http://example.com/img.gif">') >>> parse('<div data-url="http://example.com/a/b/c.html" data-some-other-value="http://example.com/img.gif">')
<div data-url="/web/20131226101010oe_/http://example.com/a/b/c.html" data-some-other-value="/web/20131226101010oe_/http://example.com/img.gif"> <div data-url="/web/20131226101010oe_/http://example.com/a/b/c.html" data-some-other-value="/web/20131226101010oe_/http://example.com/img.gif">