linkifiers: Fix problems with capture groups called "name".

Apparently, due to poor naming of the outer capture group we use to
separate the actual match from the surrounding whitespace (etc.) we
use to determine if the syntax is a possible linkifier start/end, if
you created a linkifier using "name" as the capture group, we'd try to
compile a pattern with two capture groups called "name", which would
500, preventing anyone from accessing the organization.
This commit is contained in:
Tim Abbott 2019-08-30 09:36:14 -07:00
parent 096ef1445f
commit 62c9ea7cf9
1 changed files with 9 additions and 4 deletions

View File

@ -1594,11 +1594,16 @@ class AutoNumberOListPreprocessor(markdown.preprocessors.Preprocessor):
return lines
# Name for the outer capture group we use to separate whitespace and
# other delimiters from the actual content. This value won't be an
# option in user-entered capture groups.
OUTER_CAPTURE_GROUP = "linkifier_actual_match"
def prepare_realm_pattern(source: str) -> str:
""" Augment a realm filter so it only matches after start-of-string,
"""Augment a realm filter so it only matches after start-of-string,
whitespace, or opening delimiters, won't match if there are word
characters directly after, and saves what was matched as "name". """
return r"""(?<![^\s'"\(,:<])(?P<name>""" + source + r')(?!\w)'
characters directly after, and saves what was matched as
OUTER_CAPTURE_GROUP."""
return r"""(?<![^\s'"\(,:<])(?P<%s>%s)(?!\w)""" % (OUTER_CAPTURE_GROUP, source)
# Given a regular expression pattern, linkifies groups that match it
# using the provided format string to construct the URL.
@ -1616,7 +1621,7 @@ class RealmFilterPattern(markdown.inlinepatterns.Pattern):
db_data = self.markdown.zulip_db_data
return url_to_a(db_data,
self.format_string % m.groupdict(),
m.group("name"))
m.group(OUTER_CAPTURE_GROUP))
class UserMentionPattern(markdown.inlinepatterns.Pattern):
def handleMatch(self, m: Match[str]) -> Optional[Element]: