core-parser-app 2.22.0__tar.gz → 2.23.1__tar.gz

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/PKG-INFO

@@ -1,11 +1,23 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: core_parser_app
-Version: 2.22.0
+Version: 2.23.1
 Summary: XSD parser tools for the curator core project
 Home-page: https://github.com/usnistgov/core_parser_app
 Author: NIST IT Lab
 Author-email: itl_inquiries@nist.gov
 License-File: LICENSE.md
+Requires-Dist: celery
+Requires-Dist: Django
+Requires-Dist: djangorestframework
+Requires-Dist: lxml==6.1.*
+Requires-Dist: core-main-app==2.23.*
+Dynamic: author
+Dynamic: author-email
+Dynamic: description
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: summary
 
 ===============
 Core Parser App

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/access_control.py

@@ -57,8 +57,10 @@ def _check_data_structure_element_ownership(data_structure_element, user):
     Returns:
 
     """
-    if data_structure_element.user and data_structure_element.user != str(
-        user.id
+    user_id = str(user.id) if (user and not user.is_anonymous) else None
+    if (
+        not data_structure_element.user
+        or data_structure_element.user != user_id
     ):
         raise AccessControlError("User is not the owner of the object.")
 

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/tools/modules/static/core_parser_app/js/commons/file_uploader.js

@@ -11,5 +11,5 @@ $(".custom-file span input[type=file]").on('change',function(event){
     }
 
     //replace the "Choose a file" label
-    $(this).parent().next('.custom-file-label').html(fileName);
+    $(this).parent().next('.custom-file-label').text(fileName);
 });

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/tools/modules/static/core_parser_app/js/modules.js

@@ -72,12 +72,7 @@ var saveModuleData = function($module, modData, asyncOpt) {
             var moduleResult = $(data.html).find('.moduleResult').html();
 
             $module.find('.moduleDisplay').html(moduleDisplay);
-            $module.find('.moduleResult').html(moduleResult);     
-            
-            /* look at extra data received from the server */
-            /*if ('xpath_accessor' in data){
-            	xpath_accessor(data.xpath_accessor);
-            }*/
+            $module.find('.moduleResult').text(moduleResult);
         },
         error: function() {
             console.error("An error occurred when saving module data");

core_parser_app-2.23.1/core_parser_app/tools/modules/templates/core_parser_app/builtin/checkboxes.html

@@ -0,0 +1,14 @@
+<div class="mod_checkboxes">
+	{% if label %}
+	<label>{{ label }}</label>
+	{% endif %}
+	<div class="row">
+		{% for col in columns %}
+			<div class="col">
+				{% for item in col %}
+					<span><input type="checkbox" {% if item.checked %}checked{% endif %} value="{{ item.key }}"/>{{ item.val }}</span>
+				{% endfor %}
+			</div>
+		{% endfor %}
+    </div>
+</div>

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/tools/modules/templates/core_parser_app/builtin/options.html

@@ -8,8 +8,8 @@
 	{%else%}
 	<select>
 	{% endif %}
-    	{% autoescape off %}
-		{{options}}
-		{% endautoescape %}
+	{% for opt in options%}
+	<option value="{{ opt.key }}" {% if opt.selected%}selected{% endif %}>{{ opt.val }}</option>
+	{% endfor %}
 	</select>
 </div>

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/tools/modules/templates/core_parser_app/builtin/textarea.html

@@ -2,5 +2,5 @@
 	{% if label %}
 	<label>{{label}}</label>
 	{% endif %}
-	<textarea>{{data | safe}}</textarea>
+	<textarea>{{data}}</textarea>
 </div>

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/tools/modules/templates/core_parser_app/module.html

@@ -1,7 +1,5 @@
-{% autoescape off %}
 <div class='module' style='display: inline' id="{{ module_id }}">
 	<div class='moduleContent'>{{module}}</div>
 	<div class='moduleDisplay'>{{display}}</div>
 	<div class='moduleURL' style='display: none'>{{url}}</div>
-</div>
-{% endautoescape %}
+</div>

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/tools/modules/views/builtin/checkboxes_module.py

@@ -46,26 +46,6 @@ class AbstractCheckboxesModule(AbstractModule, metaclass=ABCMeta):
         self.options = options if options is not None else dict()
         self.label = label
 
-    # FIXME: use a template to generate the HTML of the checkbox
-    @staticmethod
-    def _create_html_checkbox(input_key, input_value, checked=False):
-        """Return the html of the checkboxes
-
-        Args:
-            input_key:
-            input_value:
-            checked:
-
-        Returns:
-
-        """
-        input_tag = '<input type="checkbox" '
-        if checked:
-            input_tag += "checked "
-        input_tag += 'value="' + input_key + '"/> ' + input_value
-
-        return "<span>" + input_tag + "</span>"
-
     def _render_module(self, request):
         """Return the module
 
@@ -77,36 +57,23 @@ class AbstractCheckboxesModule(AbstractModule, metaclass=ABCMeta):
         """
         # Compute number of items in each columns
         col_nb = 3
-        opt_nb = len(self.options)
-        max_item_nb = opt_nb // col_nb
 
         # Parameters initialization
-        params = {
-            "column1": "",
-            "column2": "",
-            "column3": "",
-        }
-        item_nb = 0
-        col_id = 1
-        checkboxes_html = ""
-
-        # Filling the parameters
-        for key, val in list(self.options.items()):
-            if item_nb == max_item_nb:
-                params["column" + str(col_id)] = checkboxes_html
-
-                checkboxes_html = ""
-                item_nb = 0
-                col_id += 1
-
-            checkboxes_html += AbstractCheckboxesModule._create_html_checkbox(
-                key,
-                val,
-                checked=(key in self.selected if self.selected else False),
+        columns = [[] for _ in range(col_nb)]
+
+        for i, (key, val) in enumerate(self.options.items()):
+            col_id = i % col_nb
+            columns[col_id].append(
+                {
+                    "key": key,
+                    "val": val,
+                    "checked": (
+                        key in self.selected if self.selected else False
+                    ),
+                }
             )
-            item_nb += 1
 
-        params["column" + str(col_id)] = checkboxes_html
+        params = {"columns": columns}
 
         if self.label is not None:
             params.update({"label": self.label})

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/tools/modules/views/builtin/options_module.py

@@ -47,22 +47,16 @@ class AbstractOptionsModule(AbstractModule, metaclass=ABCMeta):
         Returns:
 
         """
-        options_html = ""
-
         if self.selected not in list(self.options.keys()):
             self.selected = None
 
+        options_list = []
         for key, val in list(self.options.items()):
-            if self.selected is not None and key == self.selected:
-                options_html += (
-                    "<option value='" + key + "' selected>" + val + "</option>"
-                )
-            else:
-                options_html += (
-                    "<option value='" + key + "'>" + val + "</option>"
-                )
-
-        params = {"options": options_html}
+            options_list.append(
+                {"key": key, "val": val, "selected": (self.selected == key)}
+            )
+
+        params = {"options": options_list}
 
         if self.label is not None:
             params.update({"label": self.label})

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/tools/modules/views/module.py

@@ -62,8 +62,6 @@ class AbstractModule(View, metaclass=ABCMeta):
             return HttpResponse(
                 json.dumps(self.is_managing_occurrences), HTTP_200_OK
             )
-        else:
-            return self._get(request)
 
     def _get(self, request):
         """Manage the GET requests

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/tools/parser/parser.py

@@ -17,6 +17,7 @@ from core_main_app.utils.requests_utils.requests_utils import send_get_request
 from core_main_app.utils.xsd_flattener.xsd_flattener_database_url import (
     XSDFlattenerDatabaseOrURL,
 )
+from core_main_app.utils.validation import url_validation
 from core_parser_app.components.data_structure.models import (
     DataStructureElement,
 )
@@ -223,7 +224,7 @@ def update_root_xpath(element, xpath, index, request=None):
         update_root_xpath(child, xpath, index, request)
 
 
-def get_nodes_xpath(elements, xml_tree, download_enabled=True, request=None):
+def get_nodes_xpath(elements, xml_tree, download_enabled=False, request=None):
     """Perform a lookup in subelements to build xpath.
 
     Get nodes' xpath, only one level deep. It's not going to every leaves. Only
@@ -295,7 +296,7 @@ def lookup_occurs(
     xml_tree,
     full_path,
     edit_data_tree,
-    download_enabled=True,
+    download_enabled=False,
     request=None,
 ):
     """Lookup in data to get the number of occurrences of a sequence or  choice
@@ -420,7 +421,7 @@ def get_element_type(
     target_namespace_prefix,
     schema_location=None,
     attr="type",
-    download_enabled=True,
+    download_enabled=False,
     request=None,
 ):
     """Get XSD type to render. Returns the tree where the type was found.
@@ -536,7 +537,7 @@ def get_element_type(
     return element_type, xml_tree, schema_location
 
 
-def import_xml_tree(el_import, download_enabled=True, request=None):
+def import_xml_tree(el_import, download_enabled=False, request=None):
     """
     Return tree after downloading import's schemaLocation
 
@@ -552,7 +553,8 @@ def import_xml_tree(el_import, download_enabled=True, request=None):
 
     if not download_enabled:
         raise ParserError("Dependency could not be downloaded")
-
+    # validate url
+    url_validation(ref_xml_schema_url)
     # download the file
     ref_xml_schema_file = send_get_request(ref_xml_schema_url)
     # read the content of the file
@@ -582,7 +584,7 @@ def get_ref_element(
     namespaces,
     element_tag,
     schema_location=None,
-    download_enabled=True,
+    download_enabled=False,
     request=None,
 ):
     """
@@ -849,9 +851,9 @@ class XSDParser:
         min_tree=True,
         ignore_modules=False,
         collapse=True,
-        auto_key_keyref=True,
+        auto_key_keyref=False,
         implicit_extension_base=False,
-        download_dependencies=True,
+        download_dependencies=False,
         store_type=False,
         request=None,
     ):
@@ -1442,9 +1444,10 @@ class XSDParser:
             # open the imported file
             download_enabled = self.download_dependencies
             if download_enabled:
-                ref_xml_schema_file = send_get_request(
-                    schema_element.options["schema_location"]
-                )
+                # validate url
+                schema_location_url = schema_element.options["schema_location"]
+                url_validation(schema_location_url)
+                ref_xml_schema_file = send_get_request(schema_location_url)
                 # get the content of the file
                 ref_xml_schema_content = ref_xml_schema_file.content
                 # build the XML tree
@@ -2036,9 +2039,10 @@ class XSDParser:
             # open the imported file
             download_enabled = self.download_dependencies
             if download_enabled:
-                ref_xml_schema_file = send_get_request(
-                    element.options["schema_location"]
-                )
+                # validate url
+                schema_location_url = element.options["schema_location"]
+                url_validation(schema_location_url)
+                ref_xml_schema_file = send_get_request(schema_location_url)
                 # get the content of the file
                 ref_xml_schema_content = ref_xml_schema_file.content
                 # build the XML tree

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/tools/parser/renderer/list.py

@@ -4,6 +4,7 @@ import logging
 from os.path import join
 
 from django.template import loader
+from django.utils.html import escape
 
 from core_parser_app.components.module import api as module_api
 from core_parser_app.tools.modules.views.module import AbstractModule
@@ -179,7 +180,7 @@ class ListRenderer(AbstractListRenderer):
         element_name = element.options["name"]
 
         if "label" in element.options and element.options["label"] != "":
-            element_name = element.options["label"]
+            element_name = escape(element.options["label"])
 
         for child_key in child_keys:
             # FIXME Use tuples instead
@@ -331,7 +332,7 @@ class ListRenderer(AbstractListRenderer):
         element_name = element.options["name"]
 
         if "label" in element.options and element.options["label"] != "":
-            element_name = element.options["label"]
+            element_name = escape(element.options["label"])
 
         for child_key in child_keys:
             sub_elements = []
@@ -607,7 +608,7 @@ class ListRenderer(AbstractListRenderer):
                     )
 
             label = (
-                element.options["label"]
+                escape(element.options["label"])
                 if "label" in element.options
                 else "Choice"
             )
@@ -791,9 +792,7 @@ class ListRenderer(AbstractListRenderer):
         module_url = module_options["url"]
 
         module = module_api.get_by_url(module_url)
-        module_view = AbstractModule.get_view_from_view_path(
-            module.view
-        ).as_view()
+        module_view = AbstractModule.get_view_from_view_path(module.view)()
 
         module_request = self.request
         module_request.method = "GET"
@@ -813,7 +812,8 @@ class ListRenderer(AbstractListRenderer):
             module_request.GET["attributes"] = module_options["attributes"]
 
         # renders the module
-        return module_view(module_request).content.decode("utf-8")
+        module_view.request = module_request
+        return module_view._get(module_request).content.decode("utf-8")
 
     def _render_list_attributes(
         self, attributes, html_content, simple_element

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/tools/parser/renderer/xml.py

@@ -5,6 +5,7 @@ import numbers
 from os.path import join
 
 from django.template import loader
+from django.utils.html import escape
 
 from xml_utils.xsd_tree.operations.xml_entities import XmlEntities
 from core_parser_app.components.data_structure_element import (
@@ -584,9 +585,13 @@ class XmlRenderer(AbstractXmlRenderer):
             elif child.tag == "attribute":
                 tmp_content[0] = self.render_attribute(child)
             elif child.tag == "union":
-                tmp_content[1] = child.value if child.value is not None else ""
+                tmp_content[1] = escape(
+                    child.value if child.value is not None else ""
+                )
             elif child.tag == "list":
-                tmp_content[1] = child.value if child.value is not None else ""
+                tmp_content[1] = escape(
+                    child.value if child.value is not None else ""
+                )
             elif child.tag == "module":
                 if child.options["multiple"]:
                     tmp_content[2] = self.render_module(child)[1]

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app/views/user/ajax.py

@@ -10,6 +10,7 @@ from core_main_app.commons.exceptions import DoesNotExist
 from core_parser_app.components.data_structure_element import (
     api as data_structure_element_api,
 )
+from core_parser_app.tools.modules.sanitize import sanitize
 
 
 @login_required
@@ -80,7 +81,7 @@ def save_data_structure_element_value(request):
         )
 
         input_previous_value = input_element.value
-        input_element.value = request.POST["value"]
+        input_element.value = sanitize(request.POST["value"])
         data_structure_element_api.upsert(input_element, request)
 
         return HttpResponse(

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app.egg-info/PKG-INFO

@@ -1,11 +1,23 @@
-Metadata-Version: 2.1
-Name: core-parser-app
-Version: 2.22.0
+Metadata-Version: 2.4
+Name: core_parser_app
+Version: 2.23.1
 Summary: XSD parser tools for the curator core project
 Home-page: https://github.com/usnistgov/core_parser_app
 Author: NIST IT Lab
 Author-email: itl_inquiries@nist.gov
 License-File: LICENSE.md
+Requires-Dist: celery
+Requires-Dist: Django
+Requires-Dist: djangorestframework
+Requires-Dist: lxml==6.1.*
+Requires-Dist: core-main-app==2.23.*
+Dynamic: author
+Dynamic: author-email
+Dynamic: description
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: summary
 
 ===============
 Core Parser App

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app.egg-info/SOURCES.txt

@@ -167,6 +167,7 @@ tests/tools/modules/__init__.py
 tests/tools/modules/tests/__init__.py
 tests/tools/modules/tests/tests_unit_checkboxes_module.py
 tests/tools/modules/tests/tests_unit_module.py
+tests/tools/modules/tests/tests_unit_options_module.py
 tests/tools/modules/tests/tests_unit_sanitize.py
 tests/tools/parser/__init__.py
 tests/tools/parser/parser/__init__.py

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/core_parser_app.egg-info/requires.txt

@@ -2,4 +2,4 @@ celery
 Django
 djangorestframework
 lxml==6.1.*
-core-main-app==2.22.*
+core-main-app==2.23.*

core_parser_app-2.23.1/requirements.core.txt

@@ -0,0 +1 @@
+core-main-app==2.23.*

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/setup.py

@@ -41,7 +41,7 @@ required = [req_link(r) if r.startswith("https://") else r for r in required]
 
 setup(
     name="core_parser_app",
-    version="2.22.0",
+    version="2.23.1",
     description="XSD parser tools for the curator core project",
     long_description=long_desc,
     author="NIST IT Lab",

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/tests/access_control/test_unit.py

@@ -48,16 +48,18 @@ class TestCheckDataStructureElementOwnership(TestCase):
                 self.mock_owned_dse, self.users["anon"]
             )
 
-    def test_anon_data_structure_random_user_pass(self):
-        """test_anon_data_structure_random_user_pass"""
+    def test_anon_data_structure_random_user_fail(self):
+        """test_anon_data_structure_random_user_fail"""
 
-        _check_data_structure_element_ownership(
-            self.mock_anon_dse, self.users["random"]
-        )
+        with self.assertRaises(AccessControlError):
+            _check_data_structure_element_ownership(
+                self.mock_anon_dse, self.users["random"]
+            )
 
-    def test_anon_data_structure_anon_user_pass(self):
-        """test_anon_data_structure_anon_user_pass"""
+    def test_anon_data_structure_anon_user_fail(self):
+        """test_anon_data_structure_anon_user_fail"""
 
-        _check_data_structure_element_ownership(
-            self.mock_anon_dse, self.users["anon"]
-        )
+        with self.assertRaises(AccessControlError):
+            _check_data_structure_element_ownership(
+                self.mock_anon_dse, self.users["anon"]
+            )

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/tests/components/data_structure_element/test_int_access_control.py

@@ -579,13 +579,16 @@ class TestDataStructureElementPermissionWithoutOwners(IntegrationBaseTestCase):
             user=AnonymousUser(), data_structure_class=MockAnonDataStructure
         )
 
-    def test_anon_user_can_access_dse_if_permission_and_no_owner(self):
-        """test_anon_user_can_access_dse_if_permission_and_no_owner"""
+    def test_anon_user_access_dse_if_permission_and_no_owner_raises_error(
+        self,
+    ):
+        """test_anon_user_access_dse_if_permission_and_no_owner_raises_error"""
 
-        _check_data_structure_elements_access(
-            [self.fixtures.data_structure_element_collection["root"]],
-            AnonymousUser(),
-        )
+        with self.assertRaises(AccessControlError):
+            _check_data_structure_elements_access(
+                [self.fixtures.data_structure_element_collection["root"]],
+                AnonymousUser(),
+            )
 
 
 class TestDataStructureElementPermissionWithoutOwnersWithoutPerm(

{core_parser_app-2.22.0 → core_parser_app-2.23.1}/tests/tools/modules/tests/tests_unit_module.py

@@ -90,7 +90,7 @@ class TestGet(TestCase):
         )
         mock_render_template.return_value = ""
 
-        response = module_object.get(request)
+        response = module_object._get(request)
 
         self.assertTrue(isinstance(response, HttpResponse))
 
@@ -124,7 +124,7 @@ class TestGet(TestCase):
         )
         mock_render_template.return_value = ""
 
-        module_object.get(request)
+        module_object._get(request)
 
         self.assertTrue(
             data_structure_element.options["data"] == "module result"

core_parser_app-2.23.1/tests/tools/modules/tests/tests_unit_options_module.py

@@ -0,0 +1,60 @@
+"""Checkboxes module unit testing"""
+
+from unittest.case import TestCase
+
+from core_main_app.utils.tests_tools.MockUser import create_mock_user
+from core_main_app.utils.tests_tools.RequestMock import create_mock_request
+from core_parser_app.tools.modules.views.builtin.options_module import (
+    AbstractOptionsModule,
+)
+
+
+class TestOptionsModule(TestCase):
+    """Test options module"""
+
+    def test_init_module_set_default_resources(self):
+        """test_init_module_set_default_resources"""
+
+        test_options = {"1": "Option One", "2": "Option Two"}
+        module_object = OptionsModule(options=test_options, selected="1")
+
+        self.assertEqual(
+            module_object.scripts, ["core_parser_app/js/builtin/options.js"]
+        )
+
+    def test_render_module_with_options(self):
+        """test_render_module_with_options"""
+
+        test_options = {"1": "Option One", "2": "Option Two"}
+        module_object = OptionsModule(options=test_options, selected="1")
+
+        mock_user = create_mock_user("1", is_superuser=True)
+        mock_request = create_mock_request(user=mock_user)
+
+        html_result = module_object._render_module(mock_request)
+        self.assertTrue("Option One" in html_result)
+        self.assertTrue("Option Two" in html_result)
+
+
+class OptionsModule(AbstractOptionsModule):
+    """Module Implementation"""
+
+    def _retrieve_data(self, request):
+        """_retrieve_data
+        Args:
+            request:
+
+        Returns:
+        """
+
+        return "module result"
+
+    def _render_data(self, request):
+        """_render_data
+        Args:
+            request:
+
+        Returns:
+        """
+
+        return "module display"