diff --git a/src/clusterfuzz/_internal/build_management/revisions.py b/src/clusterfuzz/_internal/build_management/revisions.py index 0981c7baaf5..1ce94388718 100644 --- a/src/clusterfuzz/_internal/build_management/revisions.py +++ b/src/clusterfuzz/_internal/build_management/revisions.py @@ -16,6 +16,7 @@ import ast import base64 import bisect +import html import os import re import time @@ -630,13 +631,28 @@ def format_revision_list(revisions, use_html=True): result = '' for revision in revisions: if revision['component']: - result += '%s: ' % revision['component'] + # Component names and revision text/URLs originate from a DEPS file's + # own dependency keys and 'rev'/'url' string literals, which can hold + # arbitrary content -- the AST-based parser in deps_to_revisions_dict + # restricts what *operations* a DEPS file can perform (no exec()), not + # what *content* its string literals hold. This is the same + # untrusted-content boundary _get_revision_range_html in show.py + # already escapes for its own fallback string, since the result of + # this function is likewise bound with inner-h-t-m-l there. + component = revision['component'] + if use_html: + component = html.escape(str(component), quote=True) + result += '%s: ' % component if 'link_url' in revision and revision['link_url'] and use_html: result += '{link_text}'.format( - link_url=revision['link_url'], link_text=revision['link_text']) + link_url=html.escape(str(revision['link_url']), quote=True), + link_text=html.escape(str(revision['link_text']), quote=True)) else: - result += revision['link_text'] + link_text = revision['link_text'] + if use_html: + link_text = html.escape(str(link_text), quote=True) + result += link_text if use_html: result += '
' diff --git a/src/clusterfuzz/_internal/tests/core/build_management/revisions_data/chromium_expected_html.txt b/src/clusterfuzz/_internal/tests/core/build_management/revisions_data/chromium_expected_html.txt index ca874f70e8f..3657b397e0d 100644 --- a/src/clusterfuzz/_internal/tests/core/build_management/revisions_data/chromium_expected_html.txt +++ b/src/clusterfuzz/_internal/tests/core/build_management/revisions_data/chromium_expected_html.txt @@ -1 +1 @@ -Chromium: 336903:336983
Breakpad: 0bccfcc38087bf8b71c04befe6cd83c683db980a
Buildtools: ecc8e253abac3b6186a97573871a084f4c0ca3ae
Xz: eecaf55632ca72e90eb2641376bce7cdbc7284f7
Canvas_bench: a7b40ea5ae0239517d78845a5fc9b12976bfc732
Content: c10272c88463efeef6bb19c9ec07c42bc8fe22b9
Chrome_linux: 033d053a528e820e1de3e2db766678d862a86b36
Chrome_mac: 8dc181329e7c5255f83b4b85dc2f71498a237955
Chrome_win: f8a3a845dfc845df6b14280f04f86a61959357ef
Gcdwebserver: 3d5fd0b8281a7224c057deb2d17709b5bea64836
Ppapi: 7377023e384f296cbb27644eb2c485275f1f92e8
Native_client: 9cb3a31796937176950f1727ea5b7778c9861ae5
Open-vcdiff: 438f2a5be6d809bc21611a94cd37bfc8c28ceb33
Gmock: 29763965ab52f24565299976b936d1265cb6a271
Gtest: 23574bf2333f834ff665f894c97bef8a5b33a0a9
Webkit: b0510901e78a0ea65f1f18afd440e2277d8d0dbd:bed9891540673c83756807092ee6c25793a15d6d
Android_protobuf: 999188d0dc72e97f7fe08bb756958a2cf090f4e7
Android_tools: 21f4bcbd6cd927e4b4227cfde7d5f13486be1236
Angle: e6d4e12c18f8c456ae8b95ad08f9dcf8e2558a59
Apache-mime4j: 28cb1108bff4b6cf0a2e86ff58b3d025934ebe3a
Appurify-python: ee7abd5c5ae3106f72b2a0b9d2cb55094688e867
Bidichecker: 97f2aa645b74c28c57eca56992235c79850fa9e0
Bison: 083c9a45e4affdd5464ee2b224c2df649c6e26c3
Boringssl: de24aadc5bc01130b6a9d25582203bb5308fabe1
Cardboard-java: 08ad25a04f2801bd822c3f2cd28301b68d74aef6
Chromite: 8a83c625c57a1ad990ba8f5f95890b57d204501f
Class-dump: 93e7c6a5419380d89656dcc511dc60d475199b67
Cld_2: 14d9ef8d4766326f8aa7de54402d1b9c782d4481
Colorama: 799604a1041e9b3bc5d2789ecbd7e8db2e18e6b8
Crashpad: 797adb320680a4a8ad39428075cca287e04b111f
Cros_system_api: ba08c21a075ab091ca9bdc783435c2aec8c6f807
Custom_tabs_client: 47a8e598e6116a211c320d285d887e9fb9376524
Cygwin: c89e446b273697fadf3a10ff1007a97c0b7de6df
Deqp: 194294e69d44eac48bc1fb063bd607189650aa5e
Dom_distiller_js: 81e5b59da2a7a0a518b90b5ded58670322c98128
Elfutils: 249673729a7e5dbd5de4f3760bdcaa3d23d154d7
Errorprone: 6c66e56c0f9d750aef83190466df834f9d6af8ab
Ffmpeg: 408c4b08fab5cbaa284847f8c573fe939cada87c
Findbugs: 7f69fa78a6db6dc31866d09572a0e356e921bf12
Flac: 0635a091379d9677f1ddde5f2eec85d0f096f219
Fontconfig: f16c3118e25546c1b749f9823c51827a60aeb5c1
Freetype-android: e186230678ee8e4ea4ac4797ece8125761e3225a
Freetype2: 1dd5f5f4a909866f15c92a45c9702bce290a0151
Gnu_binutils: f4003433b61b25666565690caf3d7a7a1a4ec436
Google_toolbox_for_mac: ce47a231ea0b238fbe95538e86cc61d74c234be6
Gperf: d892d79f64f9449770443fb06da49b5a1e5d33c1
Httpcomponents-client: 285c4dafc5de0e853fa845dce5773e223219601c
Httpcomponents-core: 9f7180a96f8fa5cab23f793c14b413356d419e62
Hunspell_dictionaries: 80796932b89ab36431399d76c5b8391ea471e30a
Icu: c3f79166089e5360c09e3053fce50e6e296c3204:7fe225d77f307fdbe24695179a84336ef95c1253
Jarjar: 2e1ead4c68c450e0b77fe49e3f9137842b8b6920
Jsoncpp: f572e8e42e22cfcf5ab0aea26574f408943edfa4
Jsr-305: 642c508235471f7220af6d5df2d3210e3bfc0919
Junit: 45a44647e7306262162e1346b750c3209019f2e1
Leveldatabase: 40c17c0b84ac0b791fb434096fd5c05f3819ad55
Libaddressinput: 5eeeb797e79fa01503fcdcbebdc50036fac023ef
Sources: ed98343daabd7b4497f97fda972e132e6877c48a
Talk: 38891011af54bc0f5adeddb21918b44c415938fa
Libjpeg_turbo: f4631b6ee8b1dbb05e51ae335a7886f9ac598ab6
Liblouis: 5f9c03f2a3478561deb6ae4798175094be8a26c2
Phonenumbers: 0d6e3e50e17c94262ad1ca3b7d52b11223084bca
Resources: b6dfdc7952571ff7ee72643cd88c988cbe966396
Test: f351a7e007f9c9995494499120bbc361ca808a16
Libsrtp: 9c53f858cddd4d890e405e91ff3af0b48dfd90e6
Libvpx: aa9b5f1d6e226fbeae31b2e8984d6c135c61169f
Libyuv: 6dde4f14bd3b3d1777a371feabbe8130bc043dfa
Lighttpd: 9dfa55d15937a688a92cbf2b7a8621b0927d06eb
Lss: 6f97298fe3794e92c8c896a6bc06e0b36e4c3de3
Mesa: 071d25db04c23821a12a8b260ab9d96a097402f0
Mingw: 3cc8b140b883a9fe4986d12cfd46c16a093d3527
Mockito: ed99a52e94a84bd7c467f2443b475a22fcc6ba8e
Nacl_sdk_binaries: 759dfca03bdc774da7ecbf974f6e2b84f43699a5
Nss: aab0d08a298b29407397fbb1c4219f99e99431ed
Openmax_dl: 22bb1085a6a0f6f3589a8c3d60ed0a9b82248275
Opus: cae696156f1e60006e39821e79a1811ae1933c69
Pdfium: 0de47533e05ce7ca80c48156d50a217993e97288:ac9e977a913d134c5f536eeef60a2de6941f2863
Pdfsqueeze: 5936b871e6a087b7e50d4cbcb122378d8a07499f
Pefile: 72c6ae42396cb913bcab63c15585dc3b5c3f92f1
Perl: ac0d98b5cee6c024b0cffeb4f8f45b6fc5ccdb78
Psyco_win32: f5af9f6910ee5a8075bbaeed0591469f1661d868
Py_trace_event: dd463ea9e2c430de2b9e53dea57a77b4c3ac9b30
Pyelftools: bdc1d380acd88d4bfaf47265008091483b0d614e
Pyftpdlib: 2be6d65e31c7ee6320d059f581f05ae8d89d7e45
Pywebsocket: cb349e87ddb30ff8d1fa1a89be39cec901f4a29c
Requests: f172b30356d821d180fa4ecfa3e71c7274a32de4
Robolectric: 6b63c99a8b6967acdb42cbed0adb067c80efc810
Testing: 9d7e8064f3ca2e45891470c9b5b1dce54af6a9d6
Scons-2.0.1: 1c1550e17fc26355d08627fbdec13d8291227067
Cpp: 1bdaae8fc788a5ac8936d68bf24f37d977a13dac
Skia: d3e259a16cf85454f629f5fe75b60b9863c1e138:19fb80ed14efbe9762d417fe183def089fa7cb6c
Smhasher: e87738e57558e0ec472b2fc3a643b838e5b6e88f
Snappy: 762bb32f0c9d2f31ba4958c7c0933d22e80c20bf
Stp: fc94a599207752ab4d64048204f0c88494811b62
Trace-viewer: 4cb7b12de28414d676090bd649e633b3daf53786
Ub-uiautomator: e6f02481bada8bdbdfdd7987dd6e648c44a3adcb
Usrsctplib: 36444a999739e9e408f8f587cb4c3ffeef2e50ac
Webdriver: 5fd78261a75fe08d27ca4835fb6c5ce4b42275bd
Webgl: 8986f8bfa84547b1a30a9256ebdd665024d68d71
Webpagereplay: 5da5975950daa7b30a6938da73fd0b3200901b0c
Webrtc: e566ca36dcd4c86a7e370bf2666a35b005f31aed
Xdg-utils: d80274d5869b17b8c9067a1022e4416ee7ed5e0d
Binaries: 52f9b3f4b0aa06da24ef8b123058bb61ee468881
Patched-yasm: 4671120cd8558ce62ee8672ebf3eb6f5216f909b
Deps2git: f04828eb0b5acd3e7ad983c024870f17f17b06d9
Grit: 1dac9ae64b0224beb1547810933a6f9998d0d55e
Gyp: 5122240c5e5c4d8da12c543d82b03d6089eb77c5
Acid3: 6be0a66a1ebd7ebc5abc1b2f405a945f6d871521
Swarming_client: b39a448d8522392389b28f6997126a6ab04bfe87
V8: 7fb2c3b6db3f889ea95851ca11dcb731b07a7925:4f619de4f3e98f68aae71d9a17dd5b6a550414c4
\ No newline at end of file +Chromium: 336903:336983
Breakpad: 0bccfcc38087bf8b71c04befe6cd83c683db980a
Buildtools: ecc8e253abac3b6186a97573871a084f4c0ca3ae
Xz: eecaf55632ca72e90eb2641376bce7cdbc7284f7
Canvas_bench: a7b40ea5ae0239517d78845a5fc9b12976bfc732
Content: c10272c88463efeef6bb19c9ec07c42bc8fe22b9
Chrome_linux: 033d053a528e820e1de3e2db766678d862a86b36
Chrome_mac: 8dc181329e7c5255f83b4b85dc2f71498a237955
Chrome_win: f8a3a845dfc845df6b14280f04f86a61959357ef
Gcdwebserver: 3d5fd0b8281a7224c057deb2d17709b5bea64836
Ppapi: 7377023e384f296cbb27644eb2c485275f1f92e8
Native_client: 9cb3a31796937176950f1727ea5b7778c9861ae5
Open-vcdiff: 438f2a5be6d809bc21611a94cd37bfc8c28ceb33
Gmock: 29763965ab52f24565299976b936d1265cb6a271
Gtest: 23574bf2333f834ff665f894c97bef8a5b33a0a9
Webkit: b0510901e78a0ea65f1f18afd440e2277d8d0dbd:bed9891540673c83756807092ee6c25793a15d6d
Android_protobuf: 999188d0dc72e97f7fe08bb756958a2cf090f4e7
Android_tools: 21f4bcbd6cd927e4b4227cfde7d5f13486be1236
Angle: e6d4e12c18f8c456ae8b95ad08f9dcf8e2558a59
Apache-mime4j: 28cb1108bff4b6cf0a2e86ff58b3d025934ebe3a
Appurify-python: ee7abd5c5ae3106f72b2a0b9d2cb55094688e867
Bidichecker: 97f2aa645b74c28c57eca56992235c79850fa9e0
Bison: 083c9a45e4affdd5464ee2b224c2df649c6e26c3
Boringssl: de24aadc5bc01130b6a9d25582203bb5308fabe1
Cardboard-java: 08ad25a04f2801bd822c3f2cd28301b68d74aef6
Chromite: 8a83c625c57a1ad990ba8f5f95890b57d204501f
Class-dump: 93e7c6a5419380d89656dcc511dc60d475199b67
Cld_2: 14d9ef8d4766326f8aa7de54402d1b9c782d4481
Colorama: 799604a1041e9b3bc5d2789ecbd7e8db2e18e6b8
Crashpad: 797adb320680a4a8ad39428075cca287e04b111f
Cros_system_api: ba08c21a075ab091ca9bdc783435c2aec8c6f807
Custom_tabs_client: 47a8e598e6116a211c320d285d887e9fb9376524
Cygwin: c89e446b273697fadf3a10ff1007a97c0b7de6df
Deqp: 194294e69d44eac48bc1fb063bd607189650aa5e
Dom_distiller_js: 81e5b59da2a7a0a518b90b5ded58670322c98128
Elfutils: 249673729a7e5dbd5de4f3760bdcaa3d23d154d7
Errorprone: 6c66e56c0f9d750aef83190466df834f9d6af8ab
Ffmpeg: 408c4b08fab5cbaa284847f8c573fe939cada87c
Findbugs: 7f69fa78a6db6dc31866d09572a0e356e921bf12
Flac: 0635a091379d9677f1ddde5f2eec85d0f096f219
Fontconfig: f16c3118e25546c1b749f9823c51827a60aeb5c1
Freetype-android: e186230678ee8e4ea4ac4797ece8125761e3225a
Freetype2: 1dd5f5f4a909866f15c92a45c9702bce290a0151
Gnu_binutils: f4003433b61b25666565690caf3d7a7a1a4ec436
Google_toolbox_for_mac: ce47a231ea0b238fbe95538e86cc61d74c234be6
Gperf: d892d79f64f9449770443fb06da49b5a1e5d33c1
Httpcomponents-client: 285c4dafc5de0e853fa845dce5773e223219601c
Httpcomponents-core: 9f7180a96f8fa5cab23f793c14b413356d419e62
Hunspell_dictionaries: 80796932b89ab36431399d76c5b8391ea471e30a
Icu: c3f79166089e5360c09e3053fce50e6e296c3204:7fe225d77f307fdbe24695179a84336ef95c1253
Jarjar: 2e1ead4c68c450e0b77fe49e3f9137842b8b6920
Jsoncpp: f572e8e42e22cfcf5ab0aea26574f408943edfa4
Jsr-305: 642c508235471f7220af6d5df2d3210e3bfc0919
Junit: 45a44647e7306262162e1346b750c3209019f2e1
Leveldatabase: 40c17c0b84ac0b791fb434096fd5c05f3819ad55
Libaddressinput: 5eeeb797e79fa01503fcdcbebdc50036fac023ef
Sources: ed98343daabd7b4497f97fda972e132e6877c48a
Talk: 38891011af54bc0f5adeddb21918b44c415938fa
Libjpeg_turbo: f4631b6ee8b1dbb05e51ae335a7886f9ac598ab6
Liblouis: 5f9c03f2a3478561deb6ae4798175094be8a26c2
Phonenumbers: 0d6e3e50e17c94262ad1ca3b7d52b11223084bca
Resources: b6dfdc7952571ff7ee72643cd88c988cbe966396
Test: f351a7e007f9c9995494499120bbc361ca808a16
Libsrtp: 9c53f858cddd4d890e405e91ff3af0b48dfd90e6
Libvpx: aa9b5f1d6e226fbeae31b2e8984d6c135c61169f
Libyuv: 6dde4f14bd3b3d1777a371feabbe8130bc043dfa
Lighttpd: 9dfa55d15937a688a92cbf2b7a8621b0927d06eb
Lss: 6f97298fe3794e92c8c896a6bc06e0b36e4c3de3
Mesa: 071d25db04c23821a12a8b260ab9d96a097402f0
Mingw: 3cc8b140b883a9fe4986d12cfd46c16a093d3527
Mockito: ed99a52e94a84bd7c467f2443b475a22fcc6ba8e
Nacl_sdk_binaries: 759dfca03bdc774da7ecbf974f6e2b84f43699a5
Nss: aab0d08a298b29407397fbb1c4219f99e99431ed
Openmax_dl: 22bb1085a6a0f6f3589a8c3d60ed0a9b82248275
Opus: cae696156f1e60006e39821e79a1811ae1933c69
Pdfium: 0de47533e05ce7ca80c48156d50a217993e97288:ac9e977a913d134c5f536eeef60a2de6941f2863
Pdfsqueeze: 5936b871e6a087b7e50d4cbcb122378d8a07499f
Pefile: 72c6ae42396cb913bcab63c15585dc3b5c3f92f1
Perl: ac0d98b5cee6c024b0cffeb4f8f45b6fc5ccdb78
Psyco_win32: f5af9f6910ee5a8075bbaeed0591469f1661d868
Py_trace_event: dd463ea9e2c430de2b9e53dea57a77b4c3ac9b30
Pyelftools: bdc1d380acd88d4bfaf47265008091483b0d614e
Pyftpdlib: 2be6d65e31c7ee6320d059f581f05ae8d89d7e45
Pywebsocket: cb349e87ddb30ff8d1fa1a89be39cec901f4a29c
Requests: f172b30356d821d180fa4ecfa3e71c7274a32de4
Robolectric: 6b63c99a8b6967acdb42cbed0adb067c80efc810
Testing: 9d7e8064f3ca2e45891470c9b5b1dce54af6a9d6
Scons-2.0.1: 1c1550e17fc26355d08627fbdec13d8291227067
Cpp: 1bdaae8fc788a5ac8936d68bf24f37d977a13dac
Skia: d3e259a16cf85454f629f5fe75b60b9863c1e138:19fb80ed14efbe9762d417fe183def089fa7cb6c
Smhasher: e87738e57558e0ec472b2fc3a643b838e5b6e88f
Snappy: 762bb32f0c9d2f31ba4958c7c0933d22e80c20bf
Stp: fc94a599207752ab4d64048204f0c88494811b62
Trace-viewer: 4cb7b12de28414d676090bd649e633b3daf53786
Ub-uiautomator: e6f02481bada8bdbdfdd7987dd6e648c44a3adcb
Usrsctplib: 36444a999739e9e408f8f587cb4c3ffeef2e50ac
Webdriver: 5fd78261a75fe08d27ca4835fb6c5ce4b42275bd
Webgl: 8986f8bfa84547b1a30a9256ebdd665024d68d71
Webpagereplay: 5da5975950daa7b30a6938da73fd0b3200901b0c
Webrtc: e566ca36dcd4c86a7e370bf2666a35b005f31aed
Xdg-utils: d80274d5869b17b8c9067a1022e4416ee7ed5e0d
Binaries: 52f9b3f4b0aa06da24ef8b123058bb61ee468881
Patched-yasm: 4671120cd8558ce62ee8672ebf3eb6f5216f909b
Deps2git: f04828eb0b5acd3e7ad983c024870f17f17b06d9
Grit: 1dac9ae64b0224beb1547810933a6f9998d0d55e
Gyp: 5122240c5e5c4d8da12c543d82b03d6089eb77c5
Acid3: 6be0a66a1ebd7ebc5abc1b2f405a945f6d871521
Swarming_client: b39a448d8522392389b28f6997126a6ab04bfe87
V8: 7fb2c3b6db3f889ea95851ca11dcb731b07a7925:4f619de4f3e98f68aae71d9a17dd5b6a550414c4
\ No newline at end of file diff --git a/src/clusterfuzz/_internal/tests/core/build_management/revisions_data/clank_expected_html.txt b/src/clusterfuzz/_internal/tests/core/build_management/revisions_data/clank_expected_html.txt index a3a8474d3e6..bf9e66a1d9f 100644 --- a/src/clusterfuzz/_internal/tests/core/build_management/revisions_data/clank_expected_html.txt +++ b/src/clusterfuzz/_internal/tests/core/build_management/revisions_data/clank_expected_html.txt @@ -1 +1 @@ -Chromium: 336903:336983
Clank: 6352abaaa45613ba44f1ae3cfc2d7b0ce071c48c:509c06aaa45613ba44f1ae3cfc2d7b0ce071c48c
Breakpad: 0bccfcc38087bf8b71c04befe6cd83c683db980a
Buildtools: ecc8e253abac3b6186a97573871a084f4c0ca3ae
Xz: eecaf55632ca72e90eb2641376bce7cdbc7284f7
Canvas_bench: a7b40ea5ae0239517d78845a5fc9b12976bfc732
Content: c10272c88463efeef6bb19c9ec07c42bc8fe22b9
Chrome_linux: 033d053a528e820e1de3e2db766678d862a86b36
Chrome_mac: 8dc181329e7c5255f83b4b85dc2f71498a237955
Chrome_win: f8a3a845dfc845df6b14280f04f86a61959357ef
Gcdwebserver: 3d5fd0b8281a7224c057deb2d17709b5bea64836
Ppapi: 7377023e384f296cbb27644eb2c485275f1f92e8
Native_client: 9cb3a31796937176950f1727ea5b7778c9861ae5
Open-vcdiff: 438f2a5be6d809bc21611a94cd37bfc8c28ceb33
Gmock: 29763965ab52f24565299976b936d1265cb6a271
Gtest: 23574bf2333f834ff665f894c97bef8a5b33a0a9
Webkit: b0510901e78a0ea65f1f18afd440e2277d8d0dbd:bed9891540673c83756807092ee6c25793a15d6d
Android_protobuf: 999188d0dc72e97f7fe08bb756958a2cf090f4e7
Android_tools: 21f4bcbd6cd927e4b4227cfde7d5f13486be1236
Angle: e6d4e12c18f8c456ae8b95ad08f9dcf8e2558a59
Apache-mime4j: 28cb1108bff4b6cf0a2e86ff58b3d025934ebe3a
Appurify-python: ee7abd5c5ae3106f72b2a0b9d2cb55094688e867
Bidichecker: 97f2aa645b74c28c57eca56992235c79850fa9e0
Bison: 083c9a45e4affdd5464ee2b224c2df649c6e26c3
Boringssl: de24aadc5bc01130b6a9d25582203bb5308fabe1
Cardboard-java: 08ad25a04f2801bd822c3f2cd28301b68d74aef6
Chromite: 8a83c625c57a1ad990ba8f5f95890b57d204501f
Class-dump: 93e7c6a5419380d89656dcc511dc60d475199b67
Cld_2: 14d9ef8d4766326f8aa7de54402d1b9c782d4481
Colorama: 799604a1041e9b3bc5d2789ecbd7e8db2e18e6b8
Crashpad: 797adb320680a4a8ad39428075cca287e04b111f
Cros_system_api: ba08c21a075ab091ca9bdc783435c2aec8c6f807
Custom_tabs_client: 47a8e598e6116a211c320d285d887e9fb9376524
Cygwin: c89e446b273697fadf3a10ff1007a97c0b7de6df
Deqp: 194294e69d44eac48bc1fb063bd607189650aa5e
Dom_distiller_js: 81e5b59da2a7a0a518b90b5ded58670322c98128
Elfutils: 249673729a7e5dbd5de4f3760bdcaa3d23d154d7
Errorprone: 6c66e56c0f9d750aef83190466df834f9d6af8ab
Ffmpeg: 408c4b08fab5cbaa284847f8c573fe939cada87c
Findbugs: 7f69fa78a6db6dc31866d09572a0e356e921bf12
Flac: 0635a091379d9677f1ddde5f2eec85d0f096f219
Fontconfig: f16c3118e25546c1b749f9823c51827a60aeb5c1
Freetype-android: e186230678ee8e4ea4ac4797ece8125761e3225a
Freetype2: 1dd5f5f4a909866f15c92a45c9702bce290a0151
Gnu_binutils: f4003433b61b25666565690caf3d7a7a1a4ec436
Google_toolbox_for_mac: ce47a231ea0b238fbe95538e86cc61d74c234be6
Gperf: d892d79f64f9449770443fb06da49b5a1e5d33c1
Httpcomponents-client: 285c4dafc5de0e853fa845dce5773e223219601c
Httpcomponents-core: 9f7180a96f8fa5cab23f793c14b413356d419e62
Hunspell_dictionaries: 80796932b89ab36431399d76c5b8391ea471e30a
Icu: c3f79166089e5360c09e3053fce50e6e296c3204:7fe225d77f307fdbe24695179a84336ef95c1253
Jarjar: 2e1ead4c68c450e0b77fe49e3f9137842b8b6920
Jsoncpp: f572e8e42e22cfcf5ab0aea26574f408943edfa4
Jsr-305: 642c508235471f7220af6d5df2d3210e3bfc0919
Junit: 45a44647e7306262162e1346b750c3209019f2e1
Leveldatabase: 40c17c0b84ac0b791fb434096fd5c05f3819ad55
Libaddressinput: 5eeeb797e79fa01503fcdcbebdc50036fac023ef
Sources: ed98343daabd7b4497f97fda972e132e6877c48a
Talk: 38891011af54bc0f5adeddb21918b44c415938fa
Libjpeg_turbo: f4631b6ee8b1dbb05e51ae335a7886f9ac598ab6
Liblouis: 5f9c03f2a3478561deb6ae4798175094be8a26c2
Phonenumbers: 0d6e3e50e17c94262ad1ca3b7d52b11223084bca
Resources: b6dfdc7952571ff7ee72643cd88c988cbe966396
Test: f351a7e007f9c9995494499120bbc361ca808a16
Libsrtp: 9c53f858cddd4d890e405e91ff3af0b48dfd90e6
Libvpx: aa9b5f1d6e226fbeae31b2e8984d6c135c61169f
Libyuv: 6dde4f14bd3b3d1777a371feabbe8130bc043dfa
Lighttpd: 9dfa55d15937a688a92cbf2b7a8621b0927d06eb
Lss: 6f97298fe3794e92c8c896a6bc06e0b36e4c3de3
Mesa: 071d25db04c23821a12a8b260ab9d96a097402f0
Mingw: 3cc8b140b883a9fe4986d12cfd46c16a093d3527
Mockito: ed99a52e94a84bd7c467f2443b475a22fcc6ba8e
Nacl_sdk_binaries: 759dfca03bdc774da7ecbf974f6e2b84f43699a5
Nss: aab0d08a298b29407397fbb1c4219f99e99431ed
Openmax_dl: 22bb1085a6a0f6f3589a8c3d60ed0a9b82248275
Opus: cae696156f1e60006e39821e79a1811ae1933c69
Pdfium: 0de47533e05ce7ca80c48156d50a217993e97288:ac9e977a913d134c5f536eeef60a2de6941f2863
Pdfsqueeze: 5936b871e6a087b7e50d4cbcb122378d8a07499f
Pefile: 72c6ae42396cb913bcab63c15585dc3b5c3f92f1
Perl: ac0d98b5cee6c024b0cffeb4f8f45b6fc5ccdb78
Psyco_win32: f5af9f6910ee5a8075bbaeed0591469f1661d868
Py_trace_event: dd463ea9e2c430de2b9e53dea57a77b4c3ac9b30
Pyelftools: bdc1d380acd88d4bfaf47265008091483b0d614e
Pyftpdlib: 2be6d65e31c7ee6320d059f581f05ae8d89d7e45
Pywebsocket: cb349e87ddb30ff8d1fa1a89be39cec901f4a29c
Requests: f172b30356d821d180fa4ecfa3e71c7274a32de4
Robolectric: 6b63c99a8b6967acdb42cbed0adb067c80efc810
Testing: 9d7e8064f3ca2e45891470c9b5b1dce54af6a9d6
Scons-2.0.1: 1c1550e17fc26355d08627fbdec13d8291227067
Cpp: 1bdaae8fc788a5ac8936d68bf24f37d977a13dac
Skia: d3e259a16cf85454f629f5fe75b60b9863c1e138:19fb80ed14efbe9762d417fe183def089fa7cb6c
Smhasher: e87738e57558e0ec472b2fc3a643b838e5b6e88f
Snappy: 762bb32f0c9d2f31ba4958c7c0933d22e80c20bf
Stp: fc94a599207752ab4d64048204f0c88494811b62
Trace-viewer: 4cb7b12de28414d676090bd649e633b3daf53786
Ub-uiautomator: e6f02481bada8bdbdfdd7987dd6e648c44a3adcb
Usrsctplib: 36444a999739e9e408f8f587cb4c3ffeef2e50ac
Webdriver: 5fd78261a75fe08d27ca4835fb6c5ce4b42275bd
Webgl: 8986f8bfa84547b1a30a9256ebdd665024d68d71
Webpagereplay: 5da5975950daa7b30a6938da73fd0b3200901b0c
Webrtc: e566ca36dcd4c86a7e370bf2666a35b005f31aed
Xdg-utils: d80274d5869b17b8c9067a1022e4416ee7ed5e0d
Binaries: 52f9b3f4b0aa06da24ef8b123058bb61ee468881
Patched-yasm: 4671120cd8558ce62ee8672ebf3eb6f5216f909b
Deps2git: f04828eb0b5acd3e7ad983c024870f17f17b06d9
Grit: 1dac9ae64b0224beb1547810933a6f9998d0d55e
Gyp: 5122240c5e5c4d8da12c543d82b03d6089eb77c5
Acid3: 6be0a66a1ebd7ebc5abc1b2f405a945f6d871521
Swarming_client: b39a448d8522392389b28f6997126a6ab04bfe87
V8: 7fb2c3b6db3f889ea95851ca11dcb731b07a7925:4f619de4f3e98f68aae71d9a17dd5b6a550414c4
\ No newline at end of file +Chromium: 336903:336983
Clank: 6352abaaa45613ba44f1ae3cfc2d7b0ce071c48c:509c06aaa45613ba44f1ae3cfc2d7b0ce071c48c
Breakpad: 0bccfcc38087bf8b71c04befe6cd83c683db980a
Buildtools: ecc8e253abac3b6186a97573871a084f4c0ca3ae
Xz: eecaf55632ca72e90eb2641376bce7cdbc7284f7
Canvas_bench: a7b40ea5ae0239517d78845a5fc9b12976bfc732
Content: c10272c88463efeef6bb19c9ec07c42bc8fe22b9
Chrome_linux: 033d053a528e820e1de3e2db766678d862a86b36
Chrome_mac: 8dc181329e7c5255f83b4b85dc2f71498a237955
Chrome_win: f8a3a845dfc845df6b14280f04f86a61959357ef
Gcdwebserver: 3d5fd0b8281a7224c057deb2d17709b5bea64836
Ppapi: 7377023e384f296cbb27644eb2c485275f1f92e8
Native_client: 9cb3a31796937176950f1727ea5b7778c9861ae5
Open-vcdiff: 438f2a5be6d809bc21611a94cd37bfc8c28ceb33
Gmock: 29763965ab52f24565299976b936d1265cb6a271
Gtest: 23574bf2333f834ff665f894c97bef8a5b33a0a9
Webkit: b0510901e78a0ea65f1f18afd440e2277d8d0dbd:bed9891540673c83756807092ee6c25793a15d6d
Android_protobuf: 999188d0dc72e97f7fe08bb756958a2cf090f4e7
Android_tools: 21f4bcbd6cd927e4b4227cfde7d5f13486be1236
Angle: e6d4e12c18f8c456ae8b95ad08f9dcf8e2558a59
Apache-mime4j: 28cb1108bff4b6cf0a2e86ff58b3d025934ebe3a
Appurify-python: ee7abd5c5ae3106f72b2a0b9d2cb55094688e867
Bidichecker: 97f2aa645b74c28c57eca56992235c79850fa9e0
Bison: 083c9a45e4affdd5464ee2b224c2df649c6e26c3
Boringssl: de24aadc5bc01130b6a9d25582203bb5308fabe1
Cardboard-java: 08ad25a04f2801bd822c3f2cd28301b68d74aef6
Chromite: 8a83c625c57a1ad990ba8f5f95890b57d204501f
Class-dump: 93e7c6a5419380d89656dcc511dc60d475199b67
Cld_2: 14d9ef8d4766326f8aa7de54402d1b9c782d4481
Colorama: 799604a1041e9b3bc5d2789ecbd7e8db2e18e6b8
Crashpad: 797adb320680a4a8ad39428075cca287e04b111f
Cros_system_api: ba08c21a075ab091ca9bdc783435c2aec8c6f807
Custom_tabs_client: 47a8e598e6116a211c320d285d887e9fb9376524
Cygwin: c89e446b273697fadf3a10ff1007a97c0b7de6df
Deqp: 194294e69d44eac48bc1fb063bd607189650aa5e
Dom_distiller_js: 81e5b59da2a7a0a518b90b5ded58670322c98128
Elfutils: 249673729a7e5dbd5de4f3760bdcaa3d23d154d7
Errorprone: 6c66e56c0f9d750aef83190466df834f9d6af8ab
Ffmpeg: 408c4b08fab5cbaa284847f8c573fe939cada87c
Findbugs: 7f69fa78a6db6dc31866d09572a0e356e921bf12
Flac: 0635a091379d9677f1ddde5f2eec85d0f096f219
Fontconfig: f16c3118e25546c1b749f9823c51827a60aeb5c1
Freetype-android: e186230678ee8e4ea4ac4797ece8125761e3225a
Freetype2: 1dd5f5f4a909866f15c92a45c9702bce290a0151
Gnu_binutils: f4003433b61b25666565690caf3d7a7a1a4ec436
Google_toolbox_for_mac: ce47a231ea0b238fbe95538e86cc61d74c234be6
Gperf: d892d79f64f9449770443fb06da49b5a1e5d33c1
Httpcomponents-client: 285c4dafc5de0e853fa845dce5773e223219601c
Httpcomponents-core: 9f7180a96f8fa5cab23f793c14b413356d419e62
Hunspell_dictionaries: 80796932b89ab36431399d76c5b8391ea471e30a
Icu: c3f79166089e5360c09e3053fce50e6e296c3204:7fe225d77f307fdbe24695179a84336ef95c1253
Jarjar: 2e1ead4c68c450e0b77fe49e3f9137842b8b6920
Jsoncpp: f572e8e42e22cfcf5ab0aea26574f408943edfa4
Jsr-305: 642c508235471f7220af6d5df2d3210e3bfc0919
Junit: 45a44647e7306262162e1346b750c3209019f2e1
Leveldatabase: 40c17c0b84ac0b791fb434096fd5c05f3819ad55
Libaddressinput: 5eeeb797e79fa01503fcdcbebdc50036fac023ef
Sources: ed98343daabd7b4497f97fda972e132e6877c48a
Talk: 38891011af54bc0f5adeddb21918b44c415938fa
Libjpeg_turbo: f4631b6ee8b1dbb05e51ae335a7886f9ac598ab6
Liblouis: 5f9c03f2a3478561deb6ae4798175094be8a26c2
Phonenumbers: 0d6e3e50e17c94262ad1ca3b7d52b11223084bca
Resources: b6dfdc7952571ff7ee72643cd88c988cbe966396
Test: f351a7e007f9c9995494499120bbc361ca808a16
Libsrtp: 9c53f858cddd4d890e405e91ff3af0b48dfd90e6
Libvpx: aa9b5f1d6e226fbeae31b2e8984d6c135c61169f
Libyuv: 6dde4f14bd3b3d1777a371feabbe8130bc043dfa
Lighttpd: 9dfa55d15937a688a92cbf2b7a8621b0927d06eb
Lss: 6f97298fe3794e92c8c896a6bc06e0b36e4c3de3
Mesa: 071d25db04c23821a12a8b260ab9d96a097402f0
Mingw: 3cc8b140b883a9fe4986d12cfd46c16a093d3527
Mockito: ed99a52e94a84bd7c467f2443b475a22fcc6ba8e
Nacl_sdk_binaries: 759dfca03bdc774da7ecbf974f6e2b84f43699a5
Nss: aab0d08a298b29407397fbb1c4219f99e99431ed
Openmax_dl: 22bb1085a6a0f6f3589a8c3d60ed0a9b82248275
Opus: cae696156f1e60006e39821e79a1811ae1933c69
Pdfium: 0de47533e05ce7ca80c48156d50a217993e97288:ac9e977a913d134c5f536eeef60a2de6941f2863
Pdfsqueeze: 5936b871e6a087b7e50d4cbcb122378d8a07499f
Pefile: 72c6ae42396cb913bcab63c15585dc3b5c3f92f1
Perl: ac0d98b5cee6c024b0cffeb4f8f45b6fc5ccdb78
Psyco_win32: f5af9f6910ee5a8075bbaeed0591469f1661d868
Py_trace_event: dd463ea9e2c430de2b9e53dea57a77b4c3ac9b30
Pyelftools: bdc1d380acd88d4bfaf47265008091483b0d614e
Pyftpdlib: 2be6d65e31c7ee6320d059f581f05ae8d89d7e45
Pywebsocket: cb349e87ddb30ff8d1fa1a89be39cec901f4a29c
Requests: f172b30356d821d180fa4ecfa3e71c7274a32de4
Robolectric: 6b63c99a8b6967acdb42cbed0adb067c80efc810
Testing: 9d7e8064f3ca2e45891470c9b5b1dce54af6a9d6
Scons-2.0.1: 1c1550e17fc26355d08627fbdec13d8291227067
Cpp: 1bdaae8fc788a5ac8936d68bf24f37d977a13dac
Skia: d3e259a16cf85454f629f5fe75b60b9863c1e138:19fb80ed14efbe9762d417fe183def089fa7cb6c
Smhasher: e87738e57558e0ec472b2fc3a643b838e5b6e88f
Snappy: 762bb32f0c9d2f31ba4958c7c0933d22e80c20bf
Stp: fc94a599207752ab4d64048204f0c88494811b62
Trace-viewer: 4cb7b12de28414d676090bd649e633b3daf53786
Ub-uiautomator: e6f02481bada8bdbdfdd7987dd6e648c44a3adcb
Usrsctplib: 36444a999739e9e408f8f587cb4c3ffeef2e50ac
Webdriver: 5fd78261a75fe08d27ca4835fb6c5ce4b42275bd
Webgl: 8986f8bfa84547b1a30a9256ebdd665024d68d71
Webpagereplay: 5da5975950daa7b30a6938da73fd0b3200901b0c
Webrtc: e566ca36dcd4c86a7e370bf2666a35b005f31aed
Xdg-utils: d80274d5869b17b8c9067a1022e4416ee7ed5e0d
Binaries: 52f9b3f4b0aa06da24ef8b123058bb61ee468881
Patched-yasm: 4671120cd8558ce62ee8672ebf3eb6f5216f909b
Deps2git: f04828eb0b5acd3e7ad983c024870f17f17b06d9
Grit: 1dac9ae64b0224beb1547810933a6f9998d0d55e
Gyp: 5122240c5e5c4d8da12c543d82b03d6089eb77c5
Acid3: 6be0a66a1ebd7ebc5abc1b2f405a945f6d871521
Swarming_client: b39a448d8522392389b28f6997126a6ab04bfe87
V8: 7fb2c3b6db3f889ea95851ca11dcb731b07a7925:4f619de4f3e98f68aae71d9a17dd5b6a550414c4
\ No newline at end of file diff --git a/src/clusterfuzz/_internal/tests/core/build_management/revisions_test.py b/src/clusterfuzz/_internal/tests/core/build_management/revisions_test.py index 420c88afad8..d285837a561 100644 --- a/src/clusterfuzz/_internal/tests/core/build_management/revisions_test.py +++ b/src/clusterfuzz/_internal/tests/core/build_management/revisions_test.py @@ -56,6 +56,84 @@ ] +class FormatRevisionListTest(unittest.TestCase): + """Tests for format_revision_list, focused on the escaping of + component/link_text/link_url -- these can come from a DEPS file's own + dependency keys and 'rev'/'url' string literals, which + deps_to_revisions_dict's AST-based parser restricts by *operation* (no + exec()), not by *content*. This is the same untrusted-content boundary + _get_revision_range_html in show.py escapes for its own fallback string, + since the result of this function is likewise bound with inner-h-t-m-l + there. No cloud emulator needed: this function is pure. + """ + + def test_escapes_malicious_component(self): + """A crafted DEPS dependency name/key must not inject markup.""" + result = revisions.format_revision_list([{ + 'component': '">', + 'link_text': 'irrelevant', + }]) + self.assertNotIn('', result) + self.assertIn( + '"><script>alert(document.cookie)</script>', + result) + + def test_escapes_malicious_link_text(self): + """A crafted 'rev' value must not inject markup via link_text.""" + result = revisions.format_revision_list([{ + 'component': 'src/v8', + 'link_text': '">', + }]) + self.assertNotIn('', result) + self.assertIn('"><img src=x onerror=alert(1)>', result) + + def test_escapes_malicious_link_url_breakout(self): + """A crafted 'url' value must not be able to break out of the href + attribute it is placed in.""" + result = revisions.format_revision_list([{ + 'component': 'src/v8', + 'link_text': 'irrelevant', + 'link_url': 'https://x/" onmouseover="alert(1)', + }]) + self.assertNotIn('" onmouseover="alert(1)', result) + self.assertIn('" onmouseover="alert(1)', result) + + def test_escapes_ampersand_in_legitimate_url(self): + """A real query string, e.g. Gitiles' '?pretty=fuller&n=10000', must be + escaped to & -- browsers decode this correctly when following the + link, so this does not break legitimate URLs.""" + result = revisions.format_revision_list([{ + 'component': 'V8', + 'link_text': 'abc123:def456', + 'link_url': ('https://chromium.googlesource.com/v8/v8/+log/' + 'abc123..def456?pretty=fuller&n=10000'), + }]) + self.assertIn('pretty=fuller&n=10000', result) + self.assertNotIn('pretty=fuller&n=10000', result) + + def test_use_html_false_is_unaffected(self): + """The plain-text path (use_html=False) is for non-HTML consumers and + must not be escaped.""" + result = revisions.format_revision_list( + [{ + 'component': 'src/v8', + 'link_text': 'abc123', + }], use_html=False) + self.assertEqual(result, 'src/v8: abc123\n') + + def test_legitimate_case_still_renders_a_working_link(self): + """Confirms the fix does not break normal, non-malicious output.""" + result = revisions.format_revision_list([{ + 'component': 'src/v8', + 'link_text': 'abc123..def456', + 'link_url': 'https://chromium.googlesource.com/v8/v8/+log/abc123..def456', + }]) + self.assertEqual( + result, 'src/v8: ' + 'abc123..def456
') + + @test_utils.with_cloud_emulators('datastore') class RevisionsTestcase(unittest.TestCase): """Revisions tests."""