lee/changedetection.io
1
0
Fork 0
mirror of https://github.com/dgtlmoon/changedetection.io.git synced 2026-09-28 16:26:42 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

WIP

Browse Source
This commit is contained in:
dgtlmoon
2026-09-01 16:59:30 +02:00
parent e765588089
commit 6a7fae625b
2 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changedetectionio/html_tools.py
-1
View File
@@ -164,7 +164,6 @@ _DEFAULT_UNSAFE_XPATH3_FUNCTIONS = [
]
@lru_cache(maxsize=1)
def get_safe_xpath3_parser():
"""Return an XPath3Parser subclass with filesystem/environment access functions removed.
changedetectionio/tests/test_xpath_selector.py
+5 -5
View File
@@ -595,11 +595,11 @@ def test_rss_xpath(client, live_server, measure_memory_usage, datastore_path):
# GHSA-6fmw-82m7-jq6p — XPath arbitrary file read via unparsed-text() and friends
# Unit-level: verify xpath_filter() and SafeXPath3Parser block all dangerous functions.
# Unit-level: verify xpath_filter() and the safe XPath3 parser block all dangerous functions.
def test_xpath_blocked_functions_unit():
"""Dangerous XPath 3.0 functions must be rejected at the parser level (no live server needed)."""
import elementpath
from changedetectionio.html_tools import xpath_filter, SafeXPath3Parser
from changedetectionio.html_tools import xpath_filter, get_safe_xpath3_parser
from lxml import html
html_content = '<html><body><p>safe content</p></body></html>'
@@ -627,11 +627,11 @@ def test_xpath_blocked_functions_unit():
except elementpath.ElementPathError:
pass # expected
# SafeXPath3Parser must reject the expression at parse time
# the safe parser must reject the expression at parse time
tree = html.fromstring(html_content)
try:
elementpath.select(tree, expr, parser=SafeXPath3Parser)
assert False, f"SafeXPath3Parser should have raised for: {expr!r}"
elementpath.select(tree, expr, parser=get_safe_xpath3_parser())
assert False, f"safe XPath3 parser should have raised for: {expr!r}"
except elementpath.ElementPathError:
pass # expected