Fix the wavedrom extra bypassing safe_mode

CHANGES.md

@@ -2,6 +2,7 @@
 
 ## python-markdown2 2.5.6 (not yet released)
 
+- [pull #767] Fix `wavedrom` extra bypassing `safe_mode` for the content of its fenced blocks (#765)
 - [pull #762] Speed up documents with many links by skipping the backslash-escape scan for text without a backslash
 - [pull #746] Preserve query strings and fragments in `markdown-file-links` conversions, including reference-link targets.
 - [pull #739] Fix `header-ids` extra putting sanitized HTML into header ids in safe mode, which allowed attribute injection (#649)

lib/markdown2.py

@@ -4466,6 +4466,10 @@ def sub(self, match: re.Match[str]) -> str:
             except ImportError:
                 pass
 
+        # the block is hashed below, so safe_mode would never see its content
+        if self.md.safe_mode:
+            waves = self.md._sanitize_html(waves)
+
         # hash SVG to prevent <> chars being messed with
         self.md._escape_table[waves] = _hash_text(waves)
 

test/tm-cases/wavedrom_safe_mode_escape.html

@@ -0,0 +1,11 @@
+<p>&lt;script type="WaveDrom"&gt;
+&lt;script&gt;alert("wavedrom-safe-mode-bypass")&lt;/script&gt;
+&lt;/script&gt;</p>
+
+<p>&lt;script type="WaveDrom"&gt;
+&lt;img src=x onerror=alert(1)&gt;
+&lt;/script&gt;</p>
+
+<p>&lt;script type="WaveDrom"&gt;
+{ "signal": [{ "name": "Alfa", "wave": "01.zx=ud.23.456789" }] }&lt;/script&gt;&lt;script&gt;alert(1)&lt;/script&gt;
+&lt;/script&gt;</p>

test/tm-cases/wavedrom_safe_mode_escape.opts

@@ -0,0 +1 @@
+{"safe_mode": "escape", "extras": {"wavedrom": {"prefer_embed_svg": False}}}

test/tm-cases/wavedrom_safe_mode_escape.tags

@@ -0,0 +1 @@
+extra safe_mode

test/tm-cases/wavedrom_safe_mode_escape.text

@@ -0,0 +1,11 @@
+```wavedrom
+<script>alert("wavedrom-safe-mode-bypass")</script>
+```
+
+```wavedrom
+<img src=x onerror=alert(1)>
+```
+
+```wavedrom
+{ "signal": [{ "name": "Alfa", "wave": "01.zx=ud.23.456789" }] }</script><script>alert(1)</script>
+```

test/tm-cases/wavedrom_safe_mode_replace.html

@@ -0,0 +1,8 @@
+<p>[HTML_REMOVED]
+[HTML_REMOVED][HTML_REMOVED]</p>
+
+<p>[HTML_REMOVED]
+[HTML_REMOVED][HTML_REMOVED]</p>
+
+<p>[HTML_REMOVED]
+[HTML_REMOVED][HTML_REMOVED]</p>

test/tm-cases/wavedrom_safe_mode_replace.opts

@@ -0,0 +1 @@
+{"safe_mode": "replace", "extras": {"wavedrom": {"prefer_embed_svg": False}}}

test/tm-cases/wavedrom_safe_mode_replace.tags

@@ -0,0 +1 @@
+extra safe_mode

test/tm-cases/wavedrom_safe_mode_replace.text

@@ -0,0 +1,11 @@
+```wavedrom
+<script>alert("wavedrom-safe-mode-bypass")</script>
+```
+
+```wavedrom
+<img src=x onerror=alert(1)>
+```
+
+```wavedrom
+{ "signal": [{ "name": "Alfa", "wave": "01.zx=ud.23.456789" }] }</script><script>alert(1)</script>
+```