Checking javascript inside href and src

Author: mikicz

naucse/validation.py

@@ -87,7 +87,13 @@ def check_attributes(self, attrs):
         attr_names = set([x[0] for x in attrs])
 
         if len(attr_names - self.allowed_attributes):
-            raise DisallowedAttribute("Attributes '{}' are not allowed".format(", ".join(attr_names)))
+            raise DisallowedAttribute("Attributes '{}' are not allowed".format(", ".join(attr_names - self.allowed_attributes)))
+
+        for link_attr in "href", "src":
+            if link_attr in attr_names:
+                for attr, val in attrs:
+                    if attr == link_attr and val.startswith("javascript:"):
+                        raise DisallowedAttribute("Attributes launching JavaScript are not allowed")
 
     def handle_starttag(self, tag, attrs):
         if tag not in self.allowed_elements:

test_naucse/test_validation.py

@@ -28,6 +28,15 @@ def test_allow_attributes():
             """<div class='test' onhover="alert('XSS')"><a href='/courses/'>Text</a></div>"""
         )
 
+    with pytest.raises(naucse.validation.DisallowedElement):
+        allowed_elements.reset_and_feed(
+            """<div class='test'><span style='color: red'><a href="javascript:alert('XSS')">Text</a></span></div>"""
+        )
+
+    with pytest.raises(naucse.validation.DisallowedElement):
+        allowed_elements.reset_and_feed(
+            """<div class='test' onhover="alert('XSS')"><img src="javascript:alert('XSS')" /></div>"""
+        )
 
 def test_allowed_styles():
     allowed_elements = naucse.validation.AllowedElementsParser()