Description
addons-server has a confusingly named escape_all() function that is supposed to escape content inside JSON data. It's only used in one place, in json_upload_detail, to linkify validation error messages we would return in addition to addons-linter's.
It uses linkify_with_outgoing() to linkify URLs found in that data. It escapes in a weird way, walking through the data recursively until it finds a str, calling markupsafe.escape() on them, then linkifying the result with linkify_with_outgoing() - the latter, despite using bleach/justhtml, doesn't sanitize/escape content and just linkifies.
We are only passing strings to escape_all(), and they should never contain any HTML, and should be things under our control - so we could just call linkify_and_clean() instead of escape_all(), and remove both escape_all() and linkify_with_outgoing(). That would be simpler, more consistent with how we process messages coming from the linter, and would remove a potential footgun.
Acceptance Criteria
┆Issue is synchronized with this Jira Task
Description
addons-server has a confusingly named
escape_all()function that is supposed to escape content inside JSON data. It's only used in one place, injson_upload_detail, to linkify validation error messages we would return in addition to addons-linter's.It uses
linkify_with_outgoing()to linkify URLs found in that data. It escapes in a weird way, walking through the data recursively until it finds astr, callingmarkupsafe.escape()on them, then linkifying the result withlinkify_with_outgoing()- the latter, despite using bleach/justhtml, doesn't sanitize/escape content and just linkifies.We are only passing strings to
escape_all(), and they should never contain any HTML, and should be things under our control - so we could just calllinkify_and_clean()instead ofescape_all(), and remove bothescape_all()andlinkify_with_outgoing(). That would be simpler, more consistent with how we process messages coming from the linter, and would remove a potential footgun.Acceptance Criteria
┆Issue is synchronized with this Jira Task