core | move escaping of html tags in errorinfo to django template to …

…python
PanDAWMS · Apr 24, 2023 · 8ac143b · 8ac143b
1 parent 3c6a3f1
commit 8ac143b
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 6 deletions.
diff --git a/core/libs/error.py b/core/libs/error.py
@@ -6,6 +6,7 @@
 import json
 import logging
 import numpy as np
+from html import escape
 
 from django.core.cache import cache
 
@@ -123,9 +124,13 @@ def errorInfo(job, nchars=300, mode='html', **kwargs):
     for error_cat in const.JOB_ERROR_CATEGORIES:
         if error_cat['error'] in job and job[error_cat['error']] != '' and not job[error_cat['error']] is None and int(job[error_cat['error']]) != 0 and int(job[error_cat['error']]) not in codesDescribed:
             if error_cat['diag'] is not None:
-                errtxt += '{} {}: {} <br>'.format(error_cat['title'], job[error_cat['error']], job[error_cat['diag']])
+                errtxt += '{} {}: {} <br>'.format(
+                    error_cat['title'],
+                    job[error_cat['error']],
+                    escape(job[error_cat['diag']], quote=True)
+                )
                 if err1 == '':
-                    err1 = "{}: {}".format(error_cat['name'], job[error_cat['diag']])
+                    err1 = "{}: {}".format(error_cat['name'], escape(job[error_cat['diag']], quote=True))
             else:
                 errtxt += '{} {} <br>'.format(error_cat['title'], job[error_cat['error']])
                 if err1 == '':

diff --git a/core/templates/jobInfo.html b/core/templates/jobInfo.html
@@ -116,7 +116,7 @@
       <tr><th colspan="20">Job error summary:</th></tr>
     </thead>
     <tbody>
-      <tr><td colspan="20">Error description: {{ job.errorinfo|force_escape|safe }}</td></tr>
+      <tr><td colspan="20">Error description: {{ job.errorinfo|safe }}</td></tr>
       {% if job.jobdispatchererrorcode or job.brokerageerrorcode or job.ddmerrorcode or job.exeerrorcode or job.piloterrorcode or job.superrorcode or job.taskbuffererrorcode %}
       <tr><th>Component</th><th>Code</th><th>Message</th></tr>
       {% if job.jobdispatchererrorcode %}

diff --git a/core/templates/jobInfoES.html b/core/templates/jobInfoES.html
@@ -129,7 +129,7 @@
       <tr><th colspan="20">Job error summary:</th></tr>
     </thead>
     <tbody>
-      <tr><td colspan="20">Error description: {{ job.errorinfo|force_escape|safe }}</td></tr>
+      <tr><td colspan="20">Error description: {{ job.errorinfo|safe }}</td></tr>
       {% if job.jobdispatchererrorcode or job.brokerageerrorcode or job.ddmerrorcode or job.exeerrorcode or job.piloterrorcode or job.superrorcode or job.taskbuffererrorcode %}
       <tr><th>Component</th><th>Code</th><th>Message</th></tr>
       {% if job.jobdispatchererrorcode %}

diff --git a/core/templates/jobList.html b/core/templates/jobList.html
@@ -341,7 +341,7 @@ <h6 class="float-left"><b>Overall error summary</b></h6>
     <td>{{ job.nevents }} ({{ job.ninputs }})</td>
     <td>{% if 'maxpssgbpercore' in job and job.maxpssgbpercore %}{{ job.maxpssgbpercore }}{% endif %}</td>
 		<td class="wrap small">{% if job.jobinfo != '' %}{{job.jobinfo|force_escape|safe}}<br>{% endif %}
-		{% if job.errorinfo != '' %}<span class='alarm'>{{job.errorinfo|force_escape|safe}}</span>{% endif %}
+		{% if job.errorinfo != '' %}<span class='alarm'>{{job.errorinfo|safe}}</span>{% endif %}
 		</td>
 	<tr {% if job.jobstatus == 'failed'%} class="failedjob" {% endif %}>
     <td colspan="20" class="small">Job name: <a href="{% url 'jobList' %}?jobname={{ job.jobname }}&taskid={{ job.taskid }}{% if job.jeditaskid > 0 %}&jeditaskid={{ job.jeditaskid }}{% endif %}&mode=nodrop&sortby=attemptnr">{{ job.jobname }}</a>  #{{ job.attemptnr }}</td></tr>

diff --git a/core/templates/jobListES.html b/core/templates/jobListES.html
@@ -311,7 +311,7 @@ <h6 class="float-left"><b>Overall error summary</b></h6>
         <td>{{ job.currentpriority }}</td>
         <td>{{ job.nevents }} ({{ job.ninputs }})</td>
 		<td width=250>{% if job.jobinfo != '' %}<font size=-1>{{job.jobinfo|force_escape|safe}}</font><br>{% endif %}
-		{% if job.errorinfo != '' %}<font size=-1 class='alarm'>{{job.errorinfo|force_escape|safe}}</font>{% endif %}
+		{% if job.errorinfo != '' %}<font size=-1 class='alarm'>{{job.errorinfo|safe}}</font>{% endif %}
 		</td>
 	<tr><td colspan=20> {{ job.esjobstr }} </td></tr>
 	</tr>