Merge pull request #4241 from Osmose/no-escape-bugzilla-comments

Fix bug 1423211: Do not escape stack frames in pre-filled Bugzilla comments.
mozilla-services · Dec 6, 2017 · ae0b7de · ae0b7de
2 parents 96481d1 + 7253094
commit ae0b7de
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 1 deletion.
diff --git a/webapp-django/crashstats/crashstats/jinja2/crashstats/bugzilla_comment.txt b/webapp-django/crashstats/crashstats/jinja2/crashstats/bugzilla_comment.txt
@@ -8,7 +8,7 @@ report bp-{{ uuid }}.
 Top {{ crashing_thread_frames|length }} frames of crashing thread:
 
 {% for frame in crashing_thread_frames -%}
-{{ frame.frame }} {{ frame.module }} {{ frame.signature }} {{ frame.source }}
+{{ frame.frame|safe}} {{ frame.module|safe }} {{ frame.signature|safe }} {{ frame.source|safe }}
 {% endfor %}
 =============================================================
 {% endif %}
diff --git a/webapp-django/crashstats/crashstats/tests/test_jinja_helpers.py b/webapp-django/crashstats/crashstats/tests/test_jinja_helpers.py
@@ -383,6 +383,26 @@ def test_comment_missing_everything(self):
         ])
         bugzilla_submit_url(report, parsed_dump, 0, 'Core')
 
+    def test_comment_no_html_escaping(self):
+        """If a frame contains <, >, &, or ", they should not be HTML
+        escaped in the comment body.
+
+        """
+        report = self._create_report()
+        parsed_dump = self._create_dump(threads=[
+            self._create_thread(frames=[
+                self._create_frame(
+                    frame=0,
+                    module='&test_module',
+                    signature='foo<char>::bar(char* x, int y)',
+                    file='"foo".cpp',
+                    line=7,
+                ),
+            ])
+        ])
+        url = bugzilla_submit_url(report, parsed_dump, 0, 'Core')
+        assert quote_plus('0 &test_module foo<char>::bar "foo".cpp:7') in url
+
 
 class TestReplaceBugzillaLinks(TestCase):
     def test_simple(self):