pulpcore 3.28.28__tar.gz → 3.28.30__tar.gz

{pulpcore-3.28.28 → pulpcore-3.28.30}/CHANGES.md

@@ -8,6 +8,38 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.28.30 (2024-07-16) {: #3.28.30 }
+
+
+### REST API {: #3.28.30-rest-api }
+
+#### Bugfixes {: #3.28.30-rest-api-bugfix }
+
+- Browsable HREFs now have clickable links again.
+  [#5563](https://github.com/pulp/pulpcore/issues/5563)
+
+### Plugin API {: #3.28.30-plugin-api }
+
+No significant changes.
+
+---
+
+## 3.28.29 (2024-06-24) {: #3.28.29 }
+
+
+### REST API {: #3.28.29-rest-api }
+
+#### Bugfixes {: #3.28.29-rest-api-bugfix }
+
+- Fixed openapi command where plugins relied on CONTENT_ORIGIN to be set.
+  [#5510](https://github.com/pulp/pulpcore/issues/5510)
+
+### Plugin API {: #3.28.29-plugin-api }
+
+No significant changes.
+
+---
+
 ## 3.28.28 (2024-06-18) {: #3.28.28 }
 
 

{pulpcore-3.28.28 → pulpcore-3.28.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pulpcore
-Version: 3.28.28
+Version: 3.28.30
 Summary: Pulp Django Application and Related Modules
 Home-page: https://pulpproject.org
 Author: Pulp Team

{pulpcore-3.28.28 → pulpcore-3.28.30}/functest_requirements.txt

@@ -3,8 +3,6 @@ django
 dynaconf
 drf-spectacular
 pulp-smash @ git+https://github.com/pulp/pulp-smash.git
-pulpcore-client
-pulp-file-client
 pytest<8
 python-gnupg
 proxy.py~=2.4.3

{pulpcore-3.28.28 → pulpcore-3.28.30}/pulpcore/app/apps.py

@@ -234,7 +234,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.28.28"
+    version = "3.28.30"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.28.28 → pulpcore-3.28.30}/pulpcore/app/checks.py

@@ -7,7 +7,7 @@ from django.core.checks import Error as CheckError, Warning as CheckWarning, reg
 @register(deploy=True)
 def content_origin_check(app_configs, **kwargs):
     messages = []
-    if not getattr(settings, "CONTENT_ORIGIN", None):
+    if getattr(settings, "CONTENT_ORIGIN", "UNREACHABLE") == "UNREACHABLE":
         messages.append(
             CheckError(
                 "CONTENT_ORIGIN is a required setting but it was not configured. This may be "

{pulpcore-3.28.28 → pulpcore-3.28.30}/pulpcore/app/settings.py

@@ -235,6 +235,8 @@ LOGGING = {
 
 DRF_ACCESS_POLICY = {"reusable_conditions": ["pulpcore.app.global_access_conditions"]}
 
+# This is a sentinal value for deploy checks, since we don't want to set a default one.
+CONTENT_ORIGIN = "UNREACHABLE"
 CONTENT_PATH_PREFIX = "/pulp/content/"
 CONTENT_APP_TTL = 30
 

{pulpcore-3.28.28 → pulpcore-3.28.30}/pulpcore/app/templatetags/pulp_urls.py

@@ -3,7 +3,7 @@ import re
 from django import template
 from django.conf import settings
 from django.utils.encoding import force_str
-from django.utils.html import escape
+from django.utils.html import escape, smart_urlquote
 from django.utils.safestring import SafeData, mark_safe
 
 register = template.Library()
@@ -20,6 +20,8 @@ WRAPPING_PUNCTUATION = [
     (""", """),
 ]
 word_split_re = re.compile(r"(\s+)")
+api_root_prefix = r"^" + settings.V3_API_ROOT.replace("/", r"\/")
+href_re = re.compile(api_root_prefix, re.IGNORECASE)
 
 
 @register.filter(needs_autoescape=True)
@@ -57,6 +59,9 @@ def urlize_quoted_hrefs(text, trim_url_limit=None, nofollow=True, autoescape=Tru
             url = None
             nofollow_attr = ' rel="nofollow"' if nofollow else ""
 
+            if href_re.match(middle):
+                url = smart_urlquote(middle)
+
             # Check if it's a real URL
             if url and ("{" in url or "%7B" in url):
                 url = None
@@ -74,8 +79,6 @@ def urlize_quoted_hrefs(text, trim_url_limit=None, nofollow=True, autoescape=Tru
                     words[i] = mark_safe(word)
                 elif autoescape:
                     words[i] = escape(word)
-        elif safe_input:
-            words[i] = mark_safe(word)
-        elif autoescape:
+        else:
             words[i] = escape(word)
     return "".join(words)

pulpcore-3.28.30/pulpcore/tests/unit/test_pulp_urls.py

@@ -0,0 +1,58 @@
+import pytest
+from django.conf import settings
+
+from pulpcore.app.templatetags import pulp_urls
+
+pytestmark = pytest.mark.usefixtures("fake_domain")
+
+
+def test_urlize_quoted_hrefs_basic_url():
+    """
+    text starts with API_ROOT, defaults. Should be made clickable
+    """
+    txt = settings.V3_API_ROOT + "foo/bar/"
+    ret = pulp_urls.urlize_quoted_hrefs(txt)
+    assert ret == f'<a href="{txt}" rel="nofollow">{txt}</a>'
+
+
+def test_urlize_quoted_hrefs_nofollow():
+    """
+    text starts with API_ROOT, defaults. Should be made clickable
+    """
+    txt = settings.V3_API_ROOT + "foo/bar/"
+    ret = pulp_urls.urlize_quoted_hrefs(txt, nofollow=False)
+    assert ret == f'<a href="{txt}">{txt}</a>'
+
+
+def test_urlize_quoted_hrefs_trim():
+    """
+    text starts with API_ROOT, defaults. Should be made clickable
+    """
+    txt = settings.V3_API_ROOT + "foo/bar/"
+    trim_txt = txt[0] + "..."
+    ret = pulp_urls.urlize_quoted_hrefs(txt, trim_url_limit=4)
+    assert ret == f'<a href="{txt}" rel="nofollow">{trim_txt}</a>'
+
+
+def test_urlize_quoted_hrefs_basic_url_xss():
+    """
+    text starts with API_ROOT, includes XSS, defaults. Should be made clickable, escape XSS
+    """
+    txt = settings.V3_API_ROOT + "foo/bar/<script>alert('ALERT!')</script>blech/"
+    escapified_linked_text = (
+        '<a href="' + settings.V3_API_ROOT + "foo/bar/"
+        '%3Cscript%3Ealert(&#x27;ALERT!&#x27;)%3C/script%3Eblech/" '
+        'rel="nofollow">' + settings.V3_API_ROOT + "foo/bar/&lt;script&gt;"
+        "alert(&#x27;ALERT!&#x27;)&lt;/script&gt;blech/</a>"
+    )
+    ret = pulp_urls.urlize_quoted_hrefs(txt)
+    assert ret == escapified_linked_text
+
+
+def test_urlize_quoted_hrefs_basic_escape():
+    """
+    text contains XSS. Expect escaped
+    """
+    txt = "foo/bar/<script>alert('ALERT!')</script>blech/"
+    ret = pulp_urls.urlize_quoted_hrefs(txt)
+    assert ret == "foo/bar/&lt;script&gt;alert(&#x27;ALERT!&#x27;)&lt;/script&gt;blech/"

{pulpcore-3.28.28 → pulpcore-3.28.30}/pulpcore.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pulpcore
-Version: 3.28.28
+Version: 3.28.30
 Summary: Pulp Django Application and Related Modules
 Home-page: https://pulpproject.org
 Author: Pulp Team

{pulpcore-3.28.28 → pulpcore-3.28.30}/pulpcore.egg-info/SOURCES.txt

@@ -341,6 +341,7 @@ pulpcore/tests/unit/test_cache.py
 pulpcore/tests/unit/test_content_guard.py
 pulpcore/tests/unit/test_files.py
 pulpcore/tests/unit/test_import_checks.py
+pulpcore/tests/unit/test_pulp_urls.py
 pulpcore/tests/unit/test_settings.py
 pulpcore/tests/unit/test_util.py
 pulpcore/tests/unit/content/__init__.py

{pulpcore-3.28.28 → pulpcore-3.28.30}/pulpcore.egg-info/requires.txt

@@ -4,7 +4,7 @@ aiohttp<3.9.6,>=3.8.1
 asyncio-throttle<=1.0.2,>=1.0
 backoff<2.2.2,>=2.1.2
 click<=8.1.7,>=8.1.0
-cryptography<42.0.8,>=38.0.1
+cryptography<41.0.8,>=38.0.1
 Django~=4.2.0
 django-filter<=23.5,>=23.1
 django-guid<=3.4.0,>=3.3

{pulpcore-3.28.28 → pulpcore-3.28.30}/requirements.txt

@@ -5,7 +5,7 @@ asyncio-throttle>=1.0,<=1.0.2
 async-timeout>=4.0.3,<4.0.4;python_version<"3.11"
 backoff>=2.1.2,<2.2.2
 click>=8.1.0,<=8.1.7
-cryptography>=38.0.1,<42.0.8
+cryptography>=38.0.1,<41.0.8
 Django~=4.2.0  # LTS version, switch only if we have a compelling reason to
 django-filter>=23.1,<=23.5
 django-guid>=3.3,<=3.4.0

{pulpcore-3.28.28 → pulpcore-3.28.30}/setup.py

@@ -8,7 +8,7 @@ with open("requirements.txt") as requirements:
 
 setup(
     name="pulpcore",
-    version="3.28.28",
+    version="3.28.30",
     description="Pulp Django Application and Related Modules",
     long_description=long_description,
     long_description_content_type="text/markdown",