Format issues

devel/reports.py

@@ -21,8 +21,8 @@ def __init__(self, href, title, desc):
         self.desc = desc
 
     def __str__(self):
-        link = '<a href="%s" title="%s">%s</a>'
-        return format_html(link % (self.href, self.title, self.desc))
+        return format_html('<a href="{href}" title="{title}">{desc}</a>',
+                           href=self.href, title=self.title, desc=self.desc)
 
 
 def linkify_non_reproducible_packages(statuses):

devel/tests/test_reports.py

@@ -1,6 +1,7 @@
 from django.contrib.auth.models import User
 from django.test import TransactionTestCase
 
+from devel.reports import Linkify
 from packages.models import PackageRelation
 
 
@@ -98,3 +99,12 @@ def test_report_pkgbases_filtered_by_maintainer(self):
             f'/devel/reports/old/{self.user.username}/pkgbases/')
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response.content.decode().strip(), 'linux')
+
+
+def test_linkify_escapes_html():
+    link = Linkify(href='"><script>alert(1)</script>', title='<img onerror=alert(1)>', desc='<b>xss</b>')
+    result = str(link)
+    assert '<script>' not in result
+    assert '<img' not in result
+    assert '<b>' not in result
+    assert '&lt;script&gt;' in result

devel/views.py

@@ -1,4 +1,5 @@
 import base64
+import hmac
 import operator
 import time
 from datetime import timedelta
@@ -143,9 +144,8 @@ def clock(request):
     latest_signoff = dict(Signoff.objects.filter(
         user__is_active=True).values_list('user').order_by().annotate(
             last_signoff=Max('created')))
-    # The extra() bit ensures we can use our 'user_id IS NOT NULL' index
     latest_flagreq = dict(FlagRequest.objects.filter(
-        user__is_active=True).extra(where=['user_id IS NOT NULL']).values_list(
+        user__is_active=True, user_id__isnull=False).values_list(
             'user_id').order_by().annotate(last_flagrequest=Max('created')))
     latest_log = dict(LogEntry.objects.filter(
         user__is_active=True).values_list('user').order_by().annotate(
@@ -236,7 +236,7 @@ def tier0_mirror_auth(request):
     if not user:
         return unauthorized
 
-    if user and token == user.userprofile.repos_auth_token:
+    if user and hmac.compare_digest(token, user.userprofile.repos_auth_token):
         return HttpResponse('Authorized')
     else:
         return unauthorized

main/templatetags/cdn.py

@@ -1,7 +1,6 @@
 from django import template
 from django.contrib.staticfiles.storage import staticfiles_storage
 from django.utils.html import format_html
-from django.utils.safestring import mark_safe
 
 register = template.Library()
 
@@ -11,7 +10,7 @@ def jquery() -> str:
     version = '3.6.0'
     filename = f'jquery-{version}.min.js'
     link = staticfiles_storage.url(filename)
-    return mark_safe(f'<script type="text/javascript" src="{link}"></script>')
+    return format_html('<script type="text/javascript" src="{link}"></script>', link=link)
 
 
 @register.simple_tag

news/views.py

@@ -1,5 +1,6 @@
 from django import forms
 from django.conf import settings
+from django.contrib.auth.decorators import login_required
 from django.core.mail import EmailMessage
 from django.http import HttpResponse
 from django.shortcuts import get_object_or_404, redirect
@@ -82,6 +83,7 @@ def view_redirect(request, object_id):
     return redirect(newsitem, permanent=True)
 
 
+@login_required
 @require_POST
 def preview(request):
     data = request.POST.get('data', '')

pyproject.toml

@@ -7,7 +7,7 @@ requires-python = ">=3.13"
 dependencies = [
     "bencode-py==4.1.0",
     "bleach==6.4.0",
-    "django==5.2.16",
+    "django==5.2.17",
     "django-countries==8.2.0",
     "django-csp==4.0",
     "django-prometheus==2.5.0",

sitestatic/homepage.js

@@ -51,11 +51,24 @@
     ul.style.display = "block";
     const fragment = document.createDocumentFragment();
 
-    for (let i = 0; i < pkgs.length; i++) {
+    for (const pkgname of pkgs) {
       const item = document.createElement("li");
-      const text = pkgs[i].replace(letter, `<b>${letter}</b>`);
-      item.innerHTML = `<a href="#">${text}</a>`;
-      item.setAttribute('data-value', pkgs[i]);
+      const anchor = document.createElement("a");
+      anchor.href = "#";
+
+      const matchIndex = pkgname.indexOf(letter);
+      if (matchIndex !== -1) {
+        anchor.appendChild(document.createTextNode(pkgname.slice(0, matchIndex)));
+        const bold = document.createElement("b");
+        bold.textContent = pkgname.slice(matchIndex, matchIndex + letter.length);
+        anchor.appendChild(bold);
+        anchor.appendChild(document.createTextNode(pkgname.slice(matchIndex + letter.length)));
+      } else {
+        anchor.textContent = pkgname;
+      }
+
+      item.appendChild(anchor);
+      item.setAttribute('data-value', pkgname);
       fragment.appendChild(item);
     }