diff --git a/requirements/requirements.txt b/requirements/requirements.txt index ca05c71b7..79a88872f 100644 --- a/requirements/requirements.txt +++ b/requirements/requirements.txt @@ -38,6 +38,7 @@ django-prometheus==2.2.0 asn1crypto==1.5.1 XlsxWriter==3.2.0 +nh3==0.2.22 setuptools==80.9.0 diff --git a/sapl/base/receivers.py b/sapl/base/receivers.py index f0e5365c6..a783b106b 100644 --- a/sapl/base/receivers.py +++ b/sapl/base/receivers.py @@ -8,6 +8,7 @@ from django.conf import settings from django.contrib.contenttypes.models import ContentType from django.core import serializers from django.core.files.uploadedfile import InMemoryUploadedFile, UploadedFile +from django.db.models import TextField from django.db.models.fields.files import FileField from django.db.models.signals import post_delete, post_save, \ post_migrate, pre_save, pre_migrate @@ -22,11 +23,15 @@ from sapl.decorators import receiver_multi_senders from sapl.materia.models import Tramitacao from sapl.parlamentares.models import Parlamentar from sapl.protocoloadm.models import TramitacaoAdministrativo +from sapl.sanitize import sanitize_field from sapl.utils import get_base_url, models_with_gr_for_model models_with_gr_for_autor = models_with_gr_for_model(Autor) +SAPL_APP_LABELS = frozenset( + app.rsplit('.', 1)[-1] for app in settings.SAPL_APPS) + @receiver_multi_senders(post_save, senders=models_with_gr_for_autor) def handle_update_autor_related(sender, **kwargs): @@ -477,6 +482,43 @@ def signed_files_extraction_pre_save_signal(sender, instance, **kwargs): signed_files_extraction_function(sender, instance, **kwargs) +# Cache dos TextField por modelo: a introspecção de _meta.fields a cada save +# pesa mais que a própria sanitização, e compilacao salva Dispositivo em laço. +_text_fields_cache = {} + + +def get_text_fields(model): + try: + return _text_fields_cache[model] + except KeyError: + fields = [f.name for f in model._meta.fields + if isinstance(f, TextField)] + _text_fields_cache[model] = fields + return fields + + +@receiver(pre_save, dispatch_uid='sanitize_textfields_pre_save_signal') +def sanitize_textfields_pre_save_signal(sender, instance, **kwargs): + """Remove HTML/JavaScript perigoso de todo TextField dos modelos do SAPL. + + Cobre forms, a API do drfautoapi, o admin e o shell num único ponto. + Ver sapl.sanitize para as políticas por campo. + """ + if sender._meta.app_label not in SAPL_APP_LABELS: + return + + for fieldname in get_text_fields(sender): + value = getattr(instance, fieldname, None) + if not value: + continue + sanitized = sanitize_field(sender, fieldname, value) + if sanitized != value: + setattr(instance, fieldname, sanitized) + + @receiver(pre_migrate, dispatch_uid='disconnect_signals_pre_migrate') def disconnect_signals_pre_migrate(*args, **kwargs): + # sanitize_textfields_pre_save_signal não é desconectado aqui de propósito: + # é barato e idempotente, e desconectá-lo deixaria sem proteção qualquer + # migrate rodado no mesmo processo (é o caso da suíte de testes). pre_save.disconnect(dispatch_uid='signed_files_extraction_pre_save_signal') diff --git a/sapl/base/templatetags/common_tags.py b/sapl/base/templatetags/common_tags.py index 84f61b64f..d2c741ee6 100644 --- a/sapl/base/templatetags/common_tags.py +++ b/sapl/base/templatetags/common_tags.py @@ -10,6 +10,7 @@ from sapl.base.models import AppConfig from sapl.materia.models import DocumentoAcessorio, MateriaLegislativa, Proposicao from sapl.norma.models import NormaJuridica from sapl.parlamentares.models import Filiacao +from sapl.sanitize import sanitize_html from sapl.sessao.models import SessaoPlenaria from sapl.utils import filiacao_data, SEPARADOR_HASH_PROPOSICAO, is_report_allowed @@ -396,6 +397,17 @@ def render_chunk_vendors(extension=None): return '' +@register.filter(is_safe=True) +@stringfilter +def sanitize(value): + """Renderiza HTML de campo rico (TinyMCE) sem script nem URL perigosa. + + Substitui o |safe nos campos que legitimamente guardam HTML. Protege + também as linhas gravadas antes da sanitização no pre_save. + """ + return mark_safe(sanitize_html(value, rich=True)) + + @register.filter(is_safe=True) @stringfilter def dont_break_out(value): diff --git a/sapl/base/tests/test_sanitize.py b/sapl/base/tests/test_sanitize.py new file mode 100644 index 000000000..cfa2766e3 --- /dev/null +++ b/sapl/base/tests/test_sanitize.py @@ -0,0 +1,163 @@ +import pytest +from model_bakery import baker + +from sapl.crispy_layout_mixin import get_field_display +from sapl.lexml.models import LexmlProvedor +from sapl.protocoloadm.models import TramitacaoAdministrativo +from sapl.sanitize import sanitize_field, sanitize_html, sanitize_scope +from sapl.sessao.models import ExpedienteSessao + + +def test_plain_remove_marcacao_e_preserva_texto(): + assert sanitize_html('Ciente') == 'Ciente' + assert sanitize_html('Encaminhado ao setor') == \ + 'Encaminhado ao setor' + assert sanitize_html('') == '' + assert sanitize_html('
a
b
') == 'ab' + + +def test_plain_escapa_caracteres_especiais(): + assert sanitize_html('Valor < 10 & prazo > 5') == \ + 'Valor < 10 & prazo > 5' + + +def test_plain_preserva_quebras_de_linha(): + # get_field_display converte \n em
depois de sanitizar + assert sanitize_html('linha1\nlinha2') == 'linha1\nlinha2' + + +def test_valores_vazios_atravessam(): + assert sanitize_html('') == '' + assert sanitize_html(None) is None + assert sanitize_html('', rich=True) == '' + + +@pytest.mark.parametrize('valor', [ + 'Ciente', + 'Valor < 10 & prazo > 5', + 'Encaminhado ao setor', + 'texto & cia', +]) +def test_plain_e_idempotente(valor): + """Propriedade da qual dependem as duas camadas (pre_save + renderização). + + Se sanitizar duas vezes não fosse estável, o valor gravado seria + re-escapado a cada exibição. + """ + uma_vez = sanitize_html(valor) + assert sanitize_html(uma_vez) == uma_vez + + +@pytest.mark.parametrize('valor', [ + 'Portal', + '

centro

', + '
c
', + 'ok', +]) +def test_rich_e_idempotente(valor): + uma_vez = sanitize_html(valor, rich=True) + assert sanitize_html(uma_vez, rich=True) == uma_vez + + +def test_rich_preserva_links(): + saida = sanitize_html( + 'Portal', + rich=True) + assert 'href="https://camara.gov.br"' in saida + assert 'target="_blank"' in saida + assert 'rel="noopener noreferrer"' in saida + assert '>Portal' in saida + + assert 'href="/materia/123"' in sanitize_html( + 'Matéria', rich=True) + assert 'href="mailto:a@b.c"' in sanitize_html( + 'mail', rich=True) + + +def test_rich_remove_href_perigosa_mas_mantem_o_texto(): + saida = sanitize_html( + 'clique', rich=True) + assert 'javascript' not in saida + assert 'clique' in saida + + +def test_rich_remove_script_e_manipuladores_de_evento(): + saida = sanitize_html('ok', rich=True) + assert saida == 'ok' + + assert 'onclick' not in sanitize_html( + 'x', rich=True) + assert 'onerror' not in sanitize_html( + '', rich=True) + + +def test_rich_preserva_formatacao_do_tinymce(): + """Protege contra regressão visual no conteúdo já cadastrado.""" + assert 'style="text-align: center;"' in sanitize_html( + '

centro

', rich=True) + + saida = sanitize_html( + '
c
', rich=True) + assert '' in saida and 'colspan="2"' in saida + + assert sanitize_html('', rich=True) == \ + '' + + +def test_sanitize_scope(): + assert sanitize_scope(TramitacaoAdministrativo, 'texto') == 'plain' + assert sanitize_scope(ExpedienteSessao, 'conteudo') == 'rich' + assert sanitize_scope(LexmlProvedor, 'xml') == 'exempt' + + +def test_sanitize_field_respeita_isencao(): + xml = 'y' + assert sanitize_field(LexmlProvedor, 'xml', xml) == xml + + +@pytest.mark.django_db +def test_pre_save_sanitiza_campo_simples(): + t = baker.make(TramitacaoAdministrativo, + texto='Ciente ok') + t.refresh_from_db() + assert t.texto == 'Ciente ok' + + +@pytest.mark.django_db +def test_pre_save_sanitiza_campo_rico_preservando_html(): + e = baker.make(ExpedienteSessao, + conteudo='x' + 'l') + e.refresh_from_db() + assert '' + p = baker.make(LexmlProvedor, xml=xml) + p.refresh_from_db() + assert p.xml == xml + + +@pytest.mark.django_db +def test_get_field_display_nao_devolve_script(): + t = TramitacaoAdministrativo(texto='Ciente') + __, display = get_field_display(t, 'texto') + assert 'legado') + t.refresh_from_db() + assert t.texto == 'legado' + + __, display = get_field_display(t, 'texto') + assert '