Edgewall Software

Opened 4 years ago

Closed 4 years ago

#12023 closed defect (fixed)

[wiki] wikiprocessor fails to properly render tag attributes with dashes hyphens eg. "data-collapse"

Reported by: lkraav <leho@…> Owned by: Jun Omae
Priority: normal Milestone: 1.0.6
Component: wiki system Version: 0.12
Severity: normal Keywords:
Release Notes:

Allow hyphen characters in parameter name of wiki processor.

API Changes:


How to reproduce:

  • [wiki] render_unsafe_content = true
  • edit whatever, type {{{#!div data-collapse=""
  • observe dom changes in inspector


<div collapse="">


<div data-collapse="">

Is this a Genshi bug or some Trac downstream configuration?

PS how do I add to safe_attrs list, so I could enable data-collapse or whatever without enabling full blown render_unsafe_content?

Attachments (0)

Change History (6)

comment:1 Changed 4 years ago by lkraav <leho@…>

https://developer.mozilla.org/en-US/docs/Web/Guide/HTML/Using_data_attributes this data-* is a standardized attribute class, so should be handled accordingly for sure

comment:2 Changed 4 years ago by lkraav <leho@…>


Not 100% if I'm seeing this correctly but

{{{#!div data_collapse=""

so underscore seems to get converted to hyphen data-collapse. I'm confused but I'll take it for time being.

Last edited 4 years ago by Jun Omae (previous) (diff)

comment:3 Changed 4 years ago by Jun Omae

Component: renderingwiki system
Milestone: 1.0.6
Owner: set to Jun Omae
Status: newassigned
Version: 1.1dev0.12

Currently, processor's parameter name disallows hyphen characters.

>>> from trac.wiki.parser import parse_processor_args
>>> parse_processor_args('data-name="1"')
{'name': '1'}   # ==> should be {'data-name': '1'} or {}

Also, the parser for processor's parameters has a defect.

  • trac/wiki/parser.py

    diff --git a/trac/wiki/parser.py b/trac/wiki/parser.py
    index 13efd15..bb07f7c 100644
    a b class WikiParser(Component):  
    6262    XML_NAME = r"[\w:](?<!\d)[\w:.-]*?" # See http://www.w3.org/TR/REC-xml/#id
    6464    PROCESSOR = r"(\s*)#\!([\w+-][\w+-/]*)"
    65     PROCESSOR_PARAM = r'''(?P<proc_pname>\w+)=(?P<proc_pval>".*?"|'.*?'|\w+)'''
     65    PROCESSOR_PARAM = r'''(?P<proc_pname>[-\w]+)''' \
     66                      r'''=(?P<proc_pval>".*?"|'.*?'|[-\w]+)'''
    6768    def _set_anchor(name, sep):
    6869        return r'=#(?P<anchorname>%s)(?:%s(?P<anchorlabel>[^\]]*))?' % \
    class WikiParser(Component):  
    225226        return wikitext
     229_processor_pname_re = re.compile(r'[-\w]+$')
    228232def parse_processor_args(processor_args):
    229233    """Parse a string containing parameter assignments,
    230234    and return the corresponding dictionary.
    def parse_processor_args(processor_args):  
    244248              for v in args[2::3]]
    245249    for flags in args[::3]:
    246250        for flag in flags.strip().split():
    247             if re.match(r'-?\w+$', flag):
     251            if _processor_pname_re.match(flag):
    248252                if flag[0] == '-':
    249253                    if len(flag) > 1:
    250254                        keys.append(str(flag[1:]))

We could add unit tests for parse_processor_args(). I'll post revised patch with unit tests.

comment:4 Changed 4 years ago by Jun Omae

Release Notes: modified (diff)

Proposed changes in [9159ea2d6/jomae.git].

comment:5 in reply to:  description Changed 4 years ago by Ryan J Ollos

Replying to lkraav <leho@…>:

PS how do I add to safe_attrs list, so I could enable data-collapse or whatever without enabling full blown render_unsafe_content?

I guess it is not (yet) possible: tags/trac-1.1.4/trac/util/html.py@:76#L74. Another question though is whether Genshi should just treat the data- attributes as safe, or perhaps we can do that from Trac when we move from XHMTL to HTML5. That might avoid the need for a [wiki] safe_attrs option.

Related use cases I've considered:

  • allowing unsafe content only for read-only pages, thus only WIKI_ADMIN could edit the pages when ReadonlyWikiPolicy is enabled.
  • restricting unsafe content to a specified set of pages.

Proposed change looks good to me.

comment:6 Changed 4 years ago by Jun Omae

Resolution: fixed
Status: assignedclosed

Thanks for the reviewing. Committed in [14052] and merged to trunk in [14053].

Modify Ticket

Change Properties
Set your email in Preferences
as closed The owner will remain Jun Omae.
The resolution will be deleted.
to The owner will be changed from Jun Omae to the specified user.

Add Comment

E-mail address and name can be saved in the Preferences .
Note: See TracTickets for help on using tickets.