LobotomyLabs/classquiz-ai
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

🔒 Fixed another security found out by https://github.com/aplhk

Browse Source
This commit is contained in:
Mawoka
2024-01-22 15:21:36 +01:00
parent 188a935012
commit 7e11c48891
2 changed files with 9 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
classquiz/kahoot_importer/import_quiz.py
+4 -5
View File
@@ -3,7 +3,6 @@
# SPDX-License-Identifier: MPL-2.0 # SPDX-License-Identifier: MPL-2.0
import html
import io import io
import json import json
import uuid import uuid
@@ -76,7 +75,7 @@ async def import_quiz(quiz_id: str, user: User) -> Quiz | int:
( (
ABCDQuizAnswer( ABCDQuizAnswer(
right=a.correct, right=a.correct,
answer=html.unescape(bleach.clean(a.answer, tags=[], strip=True)), answer=bleach.clean(a.answer, tags=[], strip=True),
color=DEFAULT_COLORS[i], color=DEFAULT_COLORS[i],
) )
) )
@@ -84,7 +83,7 @@ async def import_quiz(quiz_id: str, user: User) -> Quiz | int:
quiz_questions.append( quiz_questions.append(
QuizQuestion( QuizQuestion(
question=html.unescape(bleach.clean(q.question, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)), question=bleach.clean(q.question, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True),
answers=answers, answers=answers,
time=str(q.time / 1000), time=str(q.time / 1000),
image=image, image=image,
@@ -98,8 +97,8 @@ async def import_quiz(quiz_id: str, user: User) -> Quiz | int:
quiz_data = Quiz( quiz_data = Quiz(
id=quiz_id, id=quiz_id,
public=False, public=False,
title=html.unescape(bleach.clean(quiz.kahoot.title, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)), title=bleach.clean(quiz.kahoot.title, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True),
description=html.unescape(bleach.clean(quiz.kahoot.description, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True)), description=bleach.clean(quiz.kahoot.description, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True),
created_at=datetime.now(), created_at=datetime.now(),
updated_at=datetime.now(), updated_at=datetime.now(),
user_id=user.id, user_id=user.id,
classquiz/routers/editor.py
+5 -8
View File
@@ -4,7 +4,6 @@
import asyncio import asyncio
import html
import uuid import uuid
from typing import Optional from typing import Optional
@@ -81,14 +80,12 @@ async def finish_edit(edit_id: str, quiz_input: QuizInput):
if question.type == QuizQuestionType.ABCD: if question.type == QuizQuestionType.ABCD:
for i2, answer in enumerate(question.answers): for i2, answer in enumerate(question.answers):
if answer.color is not None: if answer.color is not None:
quiz_input.questions[i].answers[i2].color = html.unescape( quiz_input.questions[i].answers[i2].color = bleach.clean(answer.color, tags=[], strip=True)
bleach.clean(answer.color, tags=[], strip=True)
)
if answer.answer == "": if answer.answer == "":
quiz_input.questions[i].answers[i2].answer = None quiz_input.questions[i].answers[i2].answer = None
if answer.answer is not None: if answer.answer is not None:
quiz_input.questions[i].answers[i2].answer = html.unescape( quiz_input.questions[i].answers[i2].answer = bleach.clean(
bleach.clean(answer.answer, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True) answer.answer, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True
) )
images_to_delete = [] images_to_delete = []
@@ -96,8 +93,8 @@ async def finish_edit(edit_id: str, quiz_input: QuizInput):
for i, question in enumerate(quiz_input.questions): for i, question in enumerate(quiz_input.questions):
image = question.image image = question.image
quiz_input.questions[i].question = html.unescape( quiz_input.questions[i].question = bleach.clean(
bleach.clean(quiz_input.questions[i].question, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True) quiz_input.questions[i].question, tags=ALLOWED_TAGS_FOR_QUIZ, strip=True
) )
if image == "": if image == "":
question.image = None question.image = None