removed envipytags.py and moved name cleaning to before default name assignment

This commit is contained in:
Liam Brydon
2025-11-07 09:42:21 +13:00
parent c88b0ff3e7
commit 654707e6b5
47 changed files with 63 additions and 95 deletions

View File

@ -804,10 +804,13 @@ class Compound(EnviPathModel, AliasMixin, ScenarioMixin, ChemicalIdentifierMixin
c = Compound() c = Compound()
c.package = package c.package = package
if name is None or name.strip() == "": if name is not None:
name = f"Compound {Compound.objects.filter(package=package).count() + 1}"
# Clean for potential XSS # Clean for potential XSS
c.name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip() name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if name is None or name == "":
name = f"Compound {Compound.objects.filter(package=package).count() + 1}"
c.name = name
# We have a default here only set the value if it carries some payload # We have a default here only set the value if it carries some payload
if description is not None and description.strip() != "": if description is not None and description.strip() != "":
c.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip() c.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip()
@ -1187,12 +1190,13 @@ class SimpleAmbitRule(SimpleRule):
r = SimpleAmbitRule() r = SimpleAmbitRule()
r.package = package r.package = package
if name is not None:
if name is None or name.strip() == "": # Clean for potential XSS
name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if name is None or name == "":
name = f"Rule {Rule.objects.filter(package=package).count() + 1}" name = f"Rule {Rule.objects.filter(package=package).count() + 1}"
# Clean for potential XSS r.name = name
r.name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if description is not None and description.strip() != "": if description is not None and description.strip() != "":
r.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip() r.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip()
@ -1715,12 +1719,13 @@ class Pathway(EnviPathModel, AliasMixin, ScenarioMixin):
): ):
pw = Pathway() pw = Pathway()
pw.package = package pw.package = package
if name is not None:
if name is None or name.strip() == "": # Clean for potential XSS
name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if name is None or name == "":
name = f"Pathway {Pathway.objects.filter(package=package).count() + 1}" name = f"Pathway {Pathway.objects.filter(package=package).count() + 1}"
# Clean for potential XSS pw.name = name
pw.name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if description is not None and description.strip() != "": if description is not None and description.strip() != "":
pw.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip() pw.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip()
@ -2019,9 +2024,10 @@ class Edge(EnviPathModel, AliasMixin, ScenarioMixin):
# Clean for potential XSS # Clean for potential XSS
# Cleaning technically not needed as it is also done in Reaction.create, including it here for consistency # Cleaning technically not needed as it is also done in Reaction.create, including it here for consistency
if name is None: if name is not None:
name = f"Reaction {pathway.package.reactions.count() + 1}"
name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip() name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if name is None or name == "":
name = f"Reaction {pathway.package.reactions.count() + 1}"
if description is None: if description is None:
description = s.DEFAULT_VALUES["description"] description = s.DEFAULT_VALUES["description"]
@ -2545,12 +2551,13 @@ class RuleBasedRelativeReasoning(PackageBasedModel):
): ):
rbrr = RuleBasedRelativeReasoning() rbrr = RuleBasedRelativeReasoning()
rbrr.package = package rbrr.package = package
if name is not None:
if name is None or name.strip() == "": # Clean for potential XSS
name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if name is None or name == "":
name = f"RuleBasedRelativeReasoning {RuleBasedRelativeReasoning.objects.filter(package=package).count() + 1}" name = f"RuleBasedRelativeReasoning {RuleBasedRelativeReasoning.objects.filter(package=package).count() + 1}"
# Clean for potential XSS rbrr.name = name
rbrr.name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if description is not None and description.strip() != "": if description is not None and description.strip() != "":
rbrr.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip() rbrr.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip()
@ -2649,12 +2656,13 @@ class MLRelativeReasoning(PackageBasedModel):
): ):
mlrr = MLRelativeReasoning() mlrr = MLRelativeReasoning()
mlrr.package = package mlrr.package = package
if name is not None:
if name is None or name.strip() == "": # Clean for potential XSS
name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if name is None or name == "":
name = f"MLRelativeReasoning {MLRelativeReasoning.objects.filter(package=package).count() + 1}" name = f"MLRelativeReasoning {MLRelativeReasoning.objects.filter(package=package).count() + 1}"
# Clean for potential XSS mlrr.name = name
mlrr.name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if description is not None and description.strip() != "": if description is not None and description.strip() != "":
mlrr.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip() mlrr.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip()
@ -2964,12 +2972,13 @@ class EnviFormer(PackageBasedModel):
): ):
mod = EnviFormer() mod = EnviFormer()
mod.package = package mod.package = package
if name is not None:
if name is None or name.strip() == "": # Clean for potential XSS
name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if name is None or name == "":
name = f"EnviFormer {EnviFormer.objects.filter(package=package).count() + 1}" name = f"EnviFormer {EnviFormer.objects.filter(package=package).count() + 1}"
# Clean for potential XSS mod.name = name
mod.name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if description is not None and description.strip() != "": if description is not None and description.strip() != "":
mod.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip() mod.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip()
@ -3375,11 +3384,12 @@ class Scenario(EnviPathModel):
): ):
new_s = Scenario() new_s = Scenario()
new_s.package = package new_s.package = package
if name is not None:
if name is None or name.strip() == "": # Clean for potential XSS
name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if name is None or name == "":
name = f"Scenario {Scenario.objects.filter(package=package).count() + 1}" name = f"Scenario {Scenario.objects.filter(package=package).count() + 1}"
new_s.name = name
new_s.name = nh3.clean(name, tags=s.ALLOWED_HTML_TAGS).strip()
if description is not None and description.strip() != "": if description is not None and description.strip() != "":
new_s.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip() new_s.description = nh3.clean(description, tags=s.ALLOWED_HTML_TAGS).strip()

View File

@ -1,21 +0,0 @@
from django import template
from pydantic import AnyHttpUrl, ValidationError
from pydantic.type_adapter import TypeAdapter
register = template.Library()
url_adapter = TypeAdapter(AnyHttpUrl)
@register.filter
def classname(obj):
return obj.__class__.__name__
@register.filter
def is_url(value):
try:
url_adapter.validate_python(value)
return True
except ValidationError:
return False

View File

@ -87,7 +87,7 @@ def login(request):
from django.contrib.auth import login from django.contrib.auth import login
username = request.POST.get("username").strip() username = request.POST.get("username").strip()
if username != request.POST.get("username").strip(): if username != request.POST.get("username"):
context["message"] = "Login failed!" context["message"] = "Login failed!"
return render(request, "static/login.html", context) return render(request, "static/login.html", context)
password = request.POST.get("password") password = request.POST.get("password")

View File

@ -1,6 +1,5 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load static %} {% load static %}
{% load envipytags %}
{% block content %} {% block content %}
<div class="panel-group" id="reviewListAccordion"> <div class="panel-group" id="reviewListAccordion">

View File

@ -1,6 +1,5 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load static %} {% load static %}
{% load envipytags %}
{% block content %} {% block content %}
{% if object_type != 'package' %} {% if object_type != 'package' %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}
<div class="panel-group" id="migration-detail"> <div class="panel-group" id="migration-detail">

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}
<div class="panel-group" id="migration-detail"> <div class="panel-group" id="migration-detail">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
<div class="modal fade" tabindex="-1" id="new_model_modal" role="dialog" aria-labelledby="new_model_modal" <div class="modal fade" tabindex="-1" id="new_model_modal" role="dialog" aria-labelledby="new_model_modal"
aria-hidden="true"> aria-hidden="true">
<div class="modal-dialog modal-lg"> <div class="modal-dialog modal-lg">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<div class="modal fade" tabindex="-1" id="new_pathway_modal" role="dialog" aria-labelledby="new_pathway_modal" <div class="modal fade" tabindex="-1" id="new_pathway_modal" role="dialog" aria-labelledby="new_pathway_modal"
aria-hidden="true" style="overflow-y: auto;"> aria-hidden="true" style="overflow-y: auto;">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<div id="new_prediction_setting_modal" class="modal" tabindex="-1"> <div id="new_prediction_setting_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<div class="modal fade bs-modal-lg" id="add_pathway_edge_modal" tabindex="-1" aria-labelledby="add_pathway_edge_modal" <div class="modal fade bs-modal-lg" id="add_pathway_edge_modal" tabindex="-1" aria-labelledby="add_pathway_edge_modal"
aria-modal="true" aria-modal="true"

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Delete Edge --> <!-- Delete Edge -->
<div id="delete_pathway_edge_modal" class="modal" tabindex="-1"> <div id="delete_pathway_edge_modal" class="modal" tabindex="-1">

View File

@ -1,5 +1,5 @@
{% load static %} {% load static %}
{% load envipytags %}
<!-- Delete Node --> <!-- Delete Node -->
<div id="delete_pathway_node_modal" class="modal" tabindex="-1"> <div id="delete_pathway_node_modal" class="modal" tabindex="-1">
<div class="modal-dialog"> <div class="modal-dialog">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit Compound --> <!-- Edit Compound -->
<div id="edit_compound_modal" class="modal" tabindex="-1"> <div id="edit_compound_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit Compound --> <!-- Edit Compound -->
<div id="edit_compound_structure_modal" class="modal" tabindex="-1"> <div id="edit_compound_structure_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit Package Permission --> <!-- Edit Package Permission -->
<div id="edit_group_member_modal" class="modal" tabindex="-1"> <div id="edit_group_member_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit Model --> <!-- Edit Model -->
<div id="edit_model_modal" class="modal" tabindex="-1"> <div id="edit_model_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit Node --> <!-- Edit Node -->
<div id="edit_node_modal" class="modal" tabindex="-1"> <div id="edit_node_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit Package --> <!-- Edit Package -->
<div id="edit_package_modal" class="modal" tabindex="-1"> <div id="edit_package_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit Package Permission --> <!-- Edit Package Permission -->
<div id="edit_package_permissions_modal" class="modal" tabindex="-1"> <div id="edit_package_permissions_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit Pathway --> <!-- Edit Pathway -->
<div id="edit_pathway_modal" class="modal" tabindex="-1"> <div id="edit_pathway_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,3 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit Package --> <!-- Edit Package -->
<div id="update_prediction_settings_modal" class="modal" tabindex="-1"> <div id="update_prediction_settings_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit Reaction --> <!-- Edit Reaction -->
<div id="edit_reaction_modal" class="modal" tabindex="-1"> <div id="edit_reaction_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit Rule --> <!-- Edit Rule -->
<div id="edit_rule_modal" class="modal" tabindex="-1"> <div id="edit_rule_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Edit User --> <!-- Edit User -->
<div id="edit_user_modal" class="modal" tabindex="-1"> <div id="edit_user_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
<div class="modal fade" tabindex="-1" id="evaluate_model_modal" role="dialog" aria-labelledby="evaluate_model_modal" <div class="modal fade" tabindex="-1" id="evaluate_model_modal" role="dialog" aria-labelledby="evaluate_model_modal"
aria-hidden="true"> aria-hidden="true">
<div class="modal-dialog modal-lg"> <div class="modal-dialog modal-lg">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Copy Object --> <!-- Copy Object -->
<div id="generic_copy_object_modal" class="modal" tabindex="-1"> <div id="generic_copy_object_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<style> <style>

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<!-- Delete Object --> <!-- Delete Object -->
<div id="generic_set_external_reference_modal" class="modal" tabindex="-1"> <div id="generic_set_external_reference_modal" class="modal" tabindex="-1">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
{% load static %} {% load static %}
<div class="modal fade bs-modal-lg" id="set_scenario_modal" tabindex="-1" aria-labelledby="set_scenario_modal" <div class="modal fade bs-modal-lg" id="set_scenario_modal" tabindex="-1" aria-labelledby="set_scenario_modal"
aria-modal="true" role="dialog"> aria-modal="true" role="dialog">

View File

@ -1,4 +1,4 @@
{% load envipytags %}
<div class="modal fade" <div class="modal fade"
tabindex="-1" tabindex="-1"
id="manage_api_token_modal" id="manage_api_token_modal"

View File

@ -1,4 +1,3 @@
{% load envipytags %}
{% load static %} {% load static %}
<div class="modal fade bs-modal-lg" id="predict_modal" tabindex="-1" aria-labelledby="predict_modal" aria-modal="true" <div class="modal fade bs-modal-lg" id="predict_modal" tabindex="-1" aria-labelledby="predict_modal" aria-modal="true"
role="dialog"> role="dialog">

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}

View File

@ -1,6 +1,5 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load static %} {% load static %}
{% load envipytags %}
{% block content %} {% block content %}
{% block action_modals %} {% block action_modals %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% load static %} {% load static %}
{% block content %} {% block content %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% block content %} {% block content %}

View File

@ -1,4 +1,3 @@
{% load envipytags %}
<!DOCTYPE html> <!DOCTYPE html>
<html lang="en"> <html lang="en">
<head> <head>

View File

@ -1,5 +1,4 @@
{% extends "framework.html" %} {% extends "framework.html" %}
{% load envipytags %}
{% load static %} {% load static %}
{% block content %} {% block content %}