From ecfd928e0c0e0cca4e2052fdb5ba346ad2535d4f Mon Sep 17 00:00:00 2001 From: adityaanikam Date: Thu, 5 Nov 2026 16:01:05 +0530 Subject: [PATCH] Fix the wavedrom extra bypassing safe_mode --- CHANGES.md | 1 + lib/markdown2.py | 4 ++++ test/tm-cases/wavedrom_safe_mode_escape.html | 11 +++++++++++ test/tm-cases/wavedrom_safe_mode_escape.opts | 1 + test/tm-cases/wavedrom_safe_mode_escape.tags | 1 + test/tm-cases/wavedrom_safe_mode_escape.text | 11 +++++++++++ test/tm-cases/wavedrom_safe_mode_replace.html | 8 ++++++++ test/tm-cases/wavedrom_safe_mode_replace.opts | 1 + test/tm-cases/wavedrom_safe_mode_replace.tags | 1 + test/tm-cases/wavedrom_safe_mode_replace.text | 11 +++++++++++ 10 files changed, 50 insertions(+) create mode 100644 test/tm-cases/wavedrom_safe_mode_escape.html create mode 100644 test/tm-cases/wavedrom_safe_mode_escape.opts create mode 100644 test/tm-cases/wavedrom_safe_mode_escape.tags create mode 100644 test/tm-cases/wavedrom_safe_mode_escape.text create mode 100644 test/tm-cases/wavedrom_safe_mode_replace.html create mode 100644 test/tm-cases/wavedrom_safe_mode_replace.opts create mode 100644 test/tm-cases/wavedrom_safe_mode_replace.tags create mode 100644 test/tm-cases/wavedrom_safe_mode_replace.text diff --git a/CHANGES.md b/CHANGES.md index 93e5b900..34f8a68e 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -2,6 +2,7 @@ ## python-markdown2 2.5.6 (not yet released) +- [pull #767] Fix `wavedrom` extra bypassing `safe_mode` for the content of its fenced blocks (#765) - [pull #762] Speed up documents with many links by skipping the backslash-escape scan for text without a backslash - [pull #746] Preserve query strings and fragments in `markdown-file-links` conversions, including reference-link targets. - [pull #739] Fix `header-ids` extra putting sanitized HTML into header ids in safe mode, which allowed attribute injection (#649) diff --git a/lib/markdown2.py b/lib/markdown2.py index 9be0a262..3532c88d 100755 --- a/lib/markdown2.py +++ b/lib/markdown2.py @@ -4466,6 +4466,10 @@ def sub(self, match: re.Match[str]) -> str: except ImportError: pass + # the block is hashed below, so safe_mode would never see its content + if self.md.safe_mode: + waves = self.md._sanitize_html(waves) + # hash SVG to prevent <> chars being messed with self.md._escape_table[waves] = _hash_text(waves) diff --git a/test/tm-cases/wavedrom_safe_mode_escape.html b/test/tm-cases/wavedrom_safe_mode_escape.html new file mode 100644 index 00000000..9599d2f0 --- /dev/null +++ b/test/tm-cases/wavedrom_safe_mode_escape.html @@ -0,0 +1,11 @@ +

<script type="WaveDrom"> +<script>alert("wavedrom-safe-mode-bypass")</script> +</script>

+ +

<script type="WaveDrom"> +<img src=x onerror=alert(1)> +</script>

+ +

<script type="WaveDrom"> +{ "signal": [{ "name": "Alfa", "wave": "01.zx=ud.23.456789" }] }</script><script>alert(1)</script> +</script>

diff --git a/test/tm-cases/wavedrom_safe_mode_escape.opts b/test/tm-cases/wavedrom_safe_mode_escape.opts new file mode 100644 index 00000000..14e28350 --- /dev/null +++ b/test/tm-cases/wavedrom_safe_mode_escape.opts @@ -0,0 +1 @@ +{"safe_mode": "escape", "extras": {"wavedrom": {"prefer_embed_svg": False}}} \ No newline at end of file diff --git a/test/tm-cases/wavedrom_safe_mode_escape.tags b/test/tm-cases/wavedrom_safe_mode_escape.tags new file mode 100644 index 00000000..c91fb014 --- /dev/null +++ b/test/tm-cases/wavedrom_safe_mode_escape.tags @@ -0,0 +1 @@ +extra safe_mode diff --git a/test/tm-cases/wavedrom_safe_mode_escape.text b/test/tm-cases/wavedrom_safe_mode_escape.text new file mode 100644 index 00000000..9fa7e2bf --- /dev/null +++ b/test/tm-cases/wavedrom_safe_mode_escape.text @@ -0,0 +1,11 @@ +```wavedrom + +``` + +```wavedrom + +``` + +```wavedrom +{ "signal": [{ "name": "Alfa", "wave": "01.zx=ud.23.456789" }] } +``` diff --git a/test/tm-cases/wavedrom_safe_mode_replace.html b/test/tm-cases/wavedrom_safe_mode_replace.html new file mode 100644 index 00000000..d1d202e7 --- /dev/null +++ b/test/tm-cases/wavedrom_safe_mode_replace.html @@ -0,0 +1,8 @@ +

[HTML_REMOVED] +[HTML_REMOVED][HTML_REMOVED]

+ +

[HTML_REMOVED] +[HTML_REMOVED][HTML_REMOVED]

+ +

[HTML_REMOVED] +[HTML_REMOVED][HTML_REMOVED]

diff --git a/test/tm-cases/wavedrom_safe_mode_replace.opts b/test/tm-cases/wavedrom_safe_mode_replace.opts new file mode 100644 index 00000000..e22e6635 --- /dev/null +++ b/test/tm-cases/wavedrom_safe_mode_replace.opts @@ -0,0 +1 @@ +{"safe_mode": "replace", "extras": {"wavedrom": {"prefer_embed_svg": False}}} \ No newline at end of file diff --git a/test/tm-cases/wavedrom_safe_mode_replace.tags b/test/tm-cases/wavedrom_safe_mode_replace.tags new file mode 100644 index 00000000..c91fb014 --- /dev/null +++ b/test/tm-cases/wavedrom_safe_mode_replace.tags @@ -0,0 +1 @@ +extra safe_mode diff --git a/test/tm-cases/wavedrom_safe_mode_replace.text b/test/tm-cases/wavedrom_safe_mode_replace.text new file mode 100644 index 00000000..9fa7e2bf --- /dev/null +++ b/test/tm-cases/wavedrom_safe_mode_replace.text @@ -0,0 +1,11 @@ +```wavedrom + +``` + +```wavedrom + +``` + +```wavedrom +{ "signal": [{ "name": "Alfa", "wave": "01.zx=ud.23.456789" }] } +```