[PATCH] Double quote in attachment summary = Image macro failure

[anonymous]

1. Attach an image file [to a wiki page].
2. Attempt to display that image via, i.e. [[Image(filename.png)]]

If the summary of that attachment contains a double-quote, the image tag will be completely suppressed. (An over-sanitation of attempting to put the summary into the alt/title?)

Suggested resolution: escape " to "

As discussed here: ​http://groups.google.com/group/trac-users/browse_thread/thread/a44874225153cf1d

[maz <mzizka@…>]

The Image macro calls sanitize() on the resulting markup, and the tag ends up being removed. Removing the call to sanitize, i.e. in macros.py:

        #result = Markup(html.IMG(src=raw_url, **attr)).sanitize()
        result = html.IMG(src=raw_url, **attr)

Will results in:

<img src="/xxx/attachment/wiki/TestPage/attachment.png?format=raw" alt="&#34;this&#34; is a &#34;test&#34;" title="&#34;this&#34; is a &#34;test&#34;" />

So the quotes are properly escaped, but the sanitizing removes the result. As far as I know, manual sanitizing of this sort has not been necessary for a good while now.

[maz <mzizka@…>]

Remove sanitizing in Image macro

[maz <mzizka@…>]

Test case for embedded quotes in title

[sid]

#5381 was marked as a duplicate of this ticket.

[sid]

Oops, that last comment should have been: #5318 was marked as a duplicate of this ticket

[anonymous]

Hrm I've had to do manual sanitizing in other macros (to block <script> etc..); perhaps we should be clear about where it's getting sanitized in this case?

Is it in the way the title is fetched? To be satisfied of this I'd really like a comment or something so nobody looking at this in isolation says "hang on a second! where's the sanitization?"

If we're not clear where it's sanitized then I'd prefer to blank out questionable characters to make sure more things "pass" than remove the sanitize() call.

[Emmanuel Blot]

#6565 was marked as a duplicate of this ticket.

See also #3814.

[osimons]

This is no longer a problem with current 0.11b1+ from my testing.

Seeing this ticket actually has a patch (that I haven't looked at), I think either some dev should grab this ticket for fix in 0.10-stable, or I propose 'worksforme' with recommended solution to upgrade.

[Christian Boos]

Upgrading should be preferred, yes.