Merge branch '561487-duplicates' into development

apps/search/clients.py

@@ -1,12 +1,13 @@
 import logging
 import socket
+import re
 
 from django.conf import settings
 from django.utils.encoding import smart_unicode
 
-from .sphinxapi import SphinxClient
+from bleach import Bleach
 
-import re
+from .sphinxapi import SphinxClient
 
 MARKUP_PATTERNS = (
     (r'^!+',),
@@ -49,6 +50,8 @@ class SearchClient(object):
     Base-class for search clients
     """
 
+    bleach = Bleach()
+
     def __init__(self):
         self.sphinx = SphinxClient()
         self.sphinx.SetServer(settings.SPHINX_HOST, settings.SPHINX_PORT)
@@ -137,10 +140,10 @@ class SearchClient(object):
             excerpt = excerpt[:settings.SEARCH_SUMMARY_LENGTH] \
                 + self.truncate_pattern.sub('',
                     excerpt[settings.SEARCH_SUMMARY_LENGTH:])
-            if excerpt[-1] != '.':
+            if not excerpt.endswith('.'):
                 excerpt += u'...'
 
-        return excerpt
+        return self.bleach.clean(excerpt)
 
     def set_sort_mode(self, mode, clause=''):
         self.sphinx.SetSortMode(mode, clause)

apps/search/tests/test_search.py

@@ -340,6 +340,12 @@ class SearchTest(SphinxTestCase):
         except UnicodeDecodeError:
             self.fail('Raised UnicodeDecodeError.')
 
+    def test_clean_excerpt(self):
+        """SearchClient.excerpt() should not allow disallowed HTML through."""
+        wc = WikiClient()
+        self.assertEquals('<b>test</b>&lt;/style&gt;',
+                          wc.excerpt('test</style>', 'test'))
+
 
 def test_sphinx_down():
     """
@@ -351,6 +357,7 @@ def test_sphinx_down():
 
 query = lambda *args, **kwargs: WikiClient().query(*args, **kwargs)
 
+
 @mock.patch('search.clients.WikiClient')
 def test_excerpt_timeout(sphinx_mock):
     def sphinx_error(cls):

requirements.txt

@@ -6,6 +6,7 @@
 Jinja2==2.2.1
 -e git://github.com/jbalogh/jingo.git@c73d2c55182301e6f3ce507fc9a17ea843fed24f#egg=jingo
 -e git://github.com/jsocol/jingo-minify.git#egg=jingo-minify
+-e git://github.com/jsocol/bleach.git#egg=bleach
 
 GitPython==0.1.7
 MySQL-python==1.2.3c1