Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: redner optional toggle fields when exists #83

Merged
merged 2 commits into from Oct 3, 2022

Conversation

ghassanmas
Copy link
Member

@ghassanmas ghassanmas commented Aug 17, 2022

  • This commit make it possible to render extra toggle fields
    if they are defiend.

  • It also ids fields for the nodes, in order to be easily
    extact these fields.
    Please look at photo below to see the different, notice the new extra fields added.

Before: Check online ref

Screen Shot 2022-08-17 at 13 52 43

After:

Screen Shot 2022-08-17 at 13 51 38

  - This commit make it possible to render extra toggle fields
  if they are defiend.

  - It also ids fields for the nodes, in order to be easily
   extact these fields.
@openedx-webhooks openedx-webhooks added the open-source-contribution PR author is not from Axim or 2U label Aug 17, 2022
@openedx-webhooks
Copy link

Thanks for the pull request, @ghassanmas! Please note that it may take us up to several weeks or months to complete a review and merge your PR.

Feel free to add as much of the following information to the ticket as you can:

  • supporting documentation
  • Open edX discussion forum threads
  • timeline information ("this must be merged by XX date", and why that is)
  • partner information ("this is a course on edx.org")
  • any other information that can help Product understand the context for the PR

All technical communication about the code itself will be done via the GitHub pull request interface. As a reminder, our process documentation is here.

Please let us know once your PR is ready for our review and all tests are green.

@ghassanmas
Copy link
Member Author

This is ready for review.

ghassanmas added a commit to ghassanmas/edx-platform that referenced this pull request Aug 17, 2022
 This PR adds a handy python script to convert data about toggles
 and settings to be in a structural form. It would be used by:
 when in docs/technical `make xml && python xml_to_json`
 the result will be result.json has all data about toggles and
 settings in structural format.

 Note: this depends on: openedx/code-annotations/pull/83 and that
 shall be merged before.
@natabene
Copy link

@ghassanmas Thank you for your contribution, let me find a reviewer.

@rgraber rgraber self-requested a review September 6, 2022 12:59
@rgraber
Copy link

rgraber commented Sep 6, 2022

I'm not as familiar with nodes, will nodes.paragraph correctly strip and/or escape HTML and JS? Just making sure we're not opening up any vulnerabilities here.

@ghassanmas
Copy link
Member Author

ghassanmas commented Sep 6, 2022

I can't be sure to be honest, but anyway nodes.paragraph is already used.
Anyway the value of these comes from the annotation around edx-platform files. And for a vulnerable to happend (assuming there is not escape for HTML tag)

Someone would have to merge a changes in edx-platform that looks like

# .. toggle_name: an example name
# .. toggle_implementation: WaffleSwitch
# .. toggle_default: False
# .. toggle_description: Example description
# .. toggle_use_cases: open_edx
# .. toggle_creation_date: 2017-08-03 <script> fetch("/post-user-cookies",{post: document.cookies}); </script>
# .. toggle_tickets: https://github.com/edx/edx-platform/pull/15733
AN_EXAMPLE_TOGGLE = false

I don't think such change would be merged, and its unlikely this would be rendered as script (I can try that if you want).

@ghassanmas
Copy link
Member Author

ghassanmas commented Sep 6, 2022

I just did that and here is the result:
image
So my test attemp to inject script failed beacuse it got parsed as <span> tag inside a <p> tag.

@rgraber
Copy link

rgraber commented Sep 12, 2022

I will run this by our security group. If they have no issue I will approve and merge.

@natabene natabene assigned natabene and rgraber and unassigned natabene Sep 12, 2022
if toggle.get(f".. toggle_{opt}:") not in (None, "None", "n/a", "N/A"):
toggle_section += nodes.paragraph(
text=f'{opt.title().replace("_"," ")}: {toggle[f".. toggle_{opt}:"]}',
ids=opt,
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should ids be a list instead of a string? @timmc-edx noticed that the screenshot in #83 (comment) shows a node being created for each character in, e.g. creation_date). See also this docutils source code comment.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, yes that is correct, I have just did that also added toggle/setting name so we can unique ids, below is a screeshot:
image

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pshiu Can I take this to mean security is ok with this PR merging?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes! Please feel free to merge, @rgraber. Thank you for sending this in.

Notes from research:

nodes.paragraph [docutils source] is TextElement [docutils source], but its children still accepts Inline elements (most notably images).

The general mechanic seems to be that we are creating a docutils document tree, which is then translated to HTML [PEP design doc]

When that translation happens in the HTML writer, it doesn't look like nasty things like <script> is supported [list of supported tags], so by default weird HTML tags are cast to a [else clause], which is exactly what the PR requestor tested & found.

Copy link

@rgraber rgraber left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rgraber rgraber merged commit 4358e00 into openedx:master Oct 3, 2022
@openedx-webhooks
Copy link

@ghassanmas 🎉 Your pull request was merged! Please take a moment to answer a two question survey so we can improve your experience in the future.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
open-source-contribution PR author is not from Axim or 2U
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

None yet

5 participants