kamp/fdroidserver
1
0
Fork 0
mirror of https://gitlab.com/fdroid/fdroidserver.git synced 2024-11-09 00:40:11 +01:00
Code Activity

Fetch string contents in a safer way

Browse Source
This commit is contained in:
Daniel Martí 2015-09-30 16:12:45 -07:00
parent cc017d70d2
commit 79475d055f
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
fdroidserver/common.py
View File

@ -883,6 +883,8 @@ class vcs_bzr(vcs):
def unescape_string(string): def unescape_string(string):
if len(string) < 2:
return string
if string[0] == '"' and string[-1] == '"': if string[0] == '"' and string[-1] == '"':
return string[1:-1] return string[1:-1]
@ -891,6 +893,9 @@ def unescape_string(string):
def retrieve_string(app_dir, string, xmlfiles=None): def retrieve_string(app_dir, string, xmlfiles=None):
if not string.startswith('@string/'):
return unescape_string(string)
if xmlfiles is None: if xmlfiles is None:
xmlfiles = [] xmlfiles = []
for res_dir in [ for res_dir in [
@ -901,18 +906,21 @@ def retrieve_string(app_dir, string, xmlfiles=None):
if os.path.basename(r) == 'values': if os.path.basename(r) == 'values':
xmlfiles += [os.path.join(r, x) for x in f if x.endswith('.xml')] xmlfiles += [os.path.join(r, x) for x in f if x.endswith('.xml')]
if not string.startswith('@string/'):
return unescape_string(string)
name = string[len('@string/'):] name = string[len('@string/'):]
def element_content(element):
if element.text is None:
return ""
return element.text.encode('utf-8')
for path in xmlfiles: for path in xmlfiles:
if not os.path.isfile(path): if not os.path.isfile(path):
continue continue
xml = parse_xml(path) xml = parse_xml(path)
element = xml.find('string[@name="' + name + '"]') element = xml.find('string[@name="' + name + '"]')
if element is not None and element.text is not None: if element is not None:
return retrieve_string(app_dir, element.text.encode('utf-8'), xmlfiles) content = element_content(element)
return retrieve_string(app_dir, content, xmlfiles)
return '' return ''