X-Git-Url: https://osm.etsi.org/gitweb/?a=blobdiff_plain;f=osm_nbi%2Fhtml_out.py;h=2d5a929965f50277da54ff4f5ef26a5814c672f5;hb=28470dd553e5bcc875979a1e7a9a2096b21239f1;hp=e9237e92528ace0680315184fbcab49c8ff43400;hpb=b57758d4a3fd88baa348cfa0812e9f4a742761d1;p=osm%2FNBI.git diff --git a/osm_nbi/html_out.py b/osm_nbi/html_out.py index e9237e9..2d5a929 100644 --- a/osm_nbi/html_out.py +++ b/osm_nbi/html_out.py @@ -1,3 +1,16 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or +# implied. +# See the License for the specific language governing permissions and +# limitations under the License. + """ Contains html text in variables to make and html response """ @@ -13,7 +26,8 @@ html_start = """
-" + + yaml.safe_dump( + data, explicit_start=False, indent=4, default_flow_style=False + ) + + "" + ) + body = html_body.format(item=html_escape(request.path_info)) if response.status and response.status > 202: - body += html_body_error.format(yaml.safe_dump(data, explicit_start=True, indent=4, default_flow_style=False)) + # input request.path_info (URL) can contain XSS that are translated into output error detail + body += html_body_error.format( + html_escape( + yaml.safe_dump( + data, explicit_start=True, indent=4, default_flow_style=False + ) + ) + ) elif isinstance(data, (list, tuple)): if request.path_info == "/vnfpkgm/v1/vnf_packages": - body += html_upload_body.format(request.path_info, "VNFD") + body += html_upload_body.format(request.path_info + "_content", "VNFD") elif request.path_info == "/nsd/v1/ns_descriptors": body += html_upload_body.format(request.path_info + "_content", "NSD") elif request.path_info == "/nst/v1/nst_templates": @@ -133,31 +189,53 @@ def format(data, request, response, session): data_id = k.pop("_id", None) elif isinstance(k, str): data_id = k - body += '
{id}: {t}
'.format(url=request.path_info, id=data_id, - t=html_escape(str(k))) + body += '{id}: {t}
'.format( + url=request.path_info, id=data_id, t=html_escape(str(k)) + ) elif isinstance(data, dict): if "Location" in response.headers: body += ' show '.format(response.headers["Location"]) else: - body += ' '\ - .format(request.path_info) - if request.path_info.startswith("/nslcm/v1/ns_instances_content/") or \ - request.path_info.startswith("/nslcm/v1/ns_instances/"): - _id = request.path_info[request.path_info.rfind("/")+1:] + _id = request.path_info[request.path_info.rfind("/") + 1 :] + body += ' '.format( + request.path_info + ) + if request.path_info.startswith( + "/nslcm/v1/ns_instances_content/" + ) or request.path_info.startswith("/nslcm/v1/ns_instances/"): body += html_nslcmop_body.format(id=_id) - body += "" + html_escape(yaml.safe_dump(data, explicit_start=True, indent=4, default_flow_style=False)) + \ - "" + elif request.path_info.startswith( + "/nsilcm/v1/netslice_instances_content/" + ) or request.path_info.startswith("/nsilcm/v1/netslice_instances/"): + body += html_nsilcmop_body.format(id=_id) + elif request.path_info.startswith( + "/vnfpkgm/v1/vnf_packages/" + ) or request.path_info.startswith("/vnfpkgm/v1/vnf_packages_content/"): + body += html_vnfpackage_body.format(id=_id) + elif request.path_info.startswith( + "/nsd/v1/ns_descriptors/" + ) or request.path_info.startswith("/nsd/v1/ns_descriptors_content/"): + body += html_nspackage_body.format(id=_id) + body += ( + "
" + + html_escape( + yaml.safe_dump( + data, explicit_start=True, indent=4, default_flow_style=False + ) + ) + + "" + ) elif data is None: if request.method == "DELETE" or "METHOD=DELETE" in request.query_string: body += "
deleted" else: body = html_escape(str(data)) user_text = " " - if session: - if session.get("username"): - user_text += "user: {}".format(session.get("username")) - if session.get("project_id"): - user_text += ", project: {}".format(session.get("project_id")) + if toke_info: + if toke_info.get("username"): + user_text += "user: {}".format(toke_info.get("username")) + if toke_info.get("project_id"): + user_text += ", project: {}".format(toke_info.get("project_name")) return html_start.format(user_text) + body + html_end # yaml.safe_dump(data, explicit_start=True, indent=4, default_flow_style=False) # tags=False,