diff --git a/content.py b/content.py index 322ea0a97..0e42a24fa 100644 --- a/content.py +++ b/content.py @@ -11,7 +11,7 @@ import os import email.parser import urllib.parse from shutil import copyfile -from utils import dangerousSVG +from utils import dangerous_svg from utils import remove_domain_port from utils import isValidLanguage from utils import get_image_extensions @@ -1120,7 +1120,7 @@ def saveMediaInFormPOST(mediaBytes, debug: bool, if detectedExtension == 'svg': svgStr = mediaBytes[startPos:] svgStr = svgStr.decode() - if dangerousSVG(svgStr, False): + if dangerous_svg(svgStr, False): return None, None try: diff --git a/newswire.py b/newswire.py index 94c6d19d9..e4c34d2bb 100644 --- a/newswire.py +++ b/newswire.py @@ -18,7 +18,7 @@ from datetime import timezone from collections import OrderedDict from utils import valid_post_date from categories import setHashtagCategory -from utils import dangerousSVG +from utils import dangerous_svg from utils import get_fav_filename_from_url from utils import get_base_content_from_post from utils import has_object_dict @@ -180,7 +180,7 @@ def _downloadNewswireFeedFavicon(session, base_dir: str, # check svg for dubious scripts if favUrl.endswith('.svg'): imageDataStr = str(imageData) - if dangerousSVG(imageDataStr, False): + if dangerous_svg(imageDataStr, False): return False # save to the cache diff --git a/person.py b/person.py index 2fa452e67..c4b196960 100644 --- a/person.py +++ b/person.py @@ -59,7 +59,7 @@ from utils import acct_dir from utils import get_user_paths from utils import get_group_paths from utils import local_actor_url -from utils import dangerousSVG +from utils import dangerous_svg from session import createSession from session import getJson from webfinger import webfingerHandle @@ -1635,7 +1635,7 @@ def getPersonAvatarUrl(base_dir: str, personUrl: str, person_cache: {}, content = '' with open(imFilename, 'r') as fp: content = fp.read() - if not dangerousSVG(content, False): + if not dangerous_svg(content, False): return imPath if personJson.get('icon'): diff --git a/tests.py b/tests.py index 14141ba57..e9c090ab3 100644 --- a/tests.py +++ b/tests.py @@ -55,7 +55,7 @@ from follow import sendFollowRequestViaServer from follow import sendUnfollowRequestViaServer from siteactive import siteIsActive from utils import get_sha_256 -from utils import dangerousSVG +from utils import dangerous_svg from utils import canReplyTo from utils import is_group_account from utils import get_actor_languages_list @@ -3685,7 +3685,7 @@ def _testDangerousSVG(base_dir: str) -> None: ' ' + \ ' ' + \ '' - assert not dangerousSVG(svgContent, False) + assert not dangerous_svg(svgContent, False) svgContent = \ ' ' + \ ' ' - assert dangerousSVG(svgContent, False) + assert dangerous_svg(svgContent, False) assert not scanThemesForScripts(base_dir) diff --git a/theme.py b/theme.py index 6facaf7cc..95c05e8a8 100644 --- a/theme.py +++ b/theme.py @@ -14,7 +14,7 @@ from utils import save_json from utils import get_image_extensions from utils import copytree from utils import acct_dir -from utils import dangerousSVG +from utils import dangerous_svg from utils import local_actor_url from shutil import copyfile from shutil import make_archive @@ -902,7 +902,7 @@ def scanThemesForScripts(base_dir: str) -> bool: content = '' with open(svgFilename, 'r') as fp: content = fp.read() - svgDangerous = dangerousSVG(content, False) + svgDangerous = dangerous_svg(content, False) if svgDangerous: print('svg file contains script: ' + svgFilename) return True diff --git a/utils.py b/utils.py index df47951c0..c534baa27 100644 --- a/utils.py +++ b/utils.py @@ -897,15 +897,15 @@ def dangerous_markup(content: str, allow_local_network_access: bool) -> bool: separators, invalid_strings) -def dangerousSVG(content: str, allow_local_network_access: bool) -> bool: +def dangerous_svg(content: str, allow_local_network_access: bool) -> bool: """Returns true if the given svg file content contains dangerous scripts """ separators = [['<', '>'], ['<', '>']] - invalidStrings = [ + invalid_strings = [ 'script' ] return _is_dangerous_string(content, allow_local_network_access, - separators, invalidStrings) + separators, invalid_strings) def getDisplayName(base_dir: str, actor: str, person_cache: {}) -> str: