mirrors/synapse
1
0
Fork 0
mirror of https://github.com/element-hq/synapse.git synced 2024-12-14 11:57:44 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Hotfix: disable autoescape by default when rendering Jinja2 templates (#8394)

Browse source 
#8037 changed the default `autoescape` option when rendering Jinja2 templates from `False` to `True`. This caused some bugs, noticeably around redirect URLs being escaped in SAML2 auth confirmation templates, causing those URLs to break for users.

This change returns the previous behaviour as it stood. We may want to look at each template individually and see whether autoescaping is a good idea at some point, but for now lets just fix the breakage.
This commit is contained in:
Andrew Morgan 2020-09-24 16:24:08 +01:00 committed by GitHub
parent d191dbdaa6
commit 3f4a2a7064
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 12 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/8394.bugfix Normal file
View file

@ -0,0 +1 @@
Fix URLs being accidentally escaped in Jinja2 templates. Broke in v1.20.0.

10
synapse/config/_base.py
View file

@ -194,7 +194,10 @@ class Config:
return file_stream.read() return file_stream.read()
def read_templates( def read_templates(
self, filenames: List[str], custom_template_directory: Optional[str] = None, self,
filenames: List[str],
custom_template_directory: Optional[str] = None,
autoescape: bool = False,
) -> List[jinja2.Template]: ) -> List[jinja2.Template]:
"""Load a list of template files from disk using the given variables. """Load a list of template files from disk using the given variables.
@ -210,6 +213,9 @@ class Config:
custom_template_directory: A directory to try to look for the templates custom_template_directory: A directory to try to look for the templates
before using the default Synapse template directory instead. before using the default Synapse template directory instead.
autoescape: Whether to autoescape variables before inserting them into the
template.
Raises: Raises:
ConfigError: if the file's path is incorrect or otherwise cannot be read. ConfigError: if the file's path is incorrect or otherwise cannot be read.
@ -233,7 +239,7 @@ class Config:
search_directories.insert(0, custom_template_directory) search_directories.insert(0, custom_template_directory)
loader = jinja2.FileSystemLoader(search_directories) loader = jinja2.FileSystemLoader(search_directories)
env = jinja2.Environment(loader=loader, autoescape=True) env = jinja2.Environment(loader=loader, autoescape=autoescape)
# Update the environment with our custom filters # Update the environment with our custom filters
env.filters.update( env.filters.update(

4
synapse/config/saml2_config.py
View file

@ -169,8 +169,10 @@ class SAML2Config(Config):
saml2_config.get("saml_session_lifetime", "15m") saml2_config.get("saml_session_lifetime", "15m")
) )
# We enable autoescape here as the message may potentially come from a
# remote resource
self.saml2_error_html_template = self.read_templates( self.saml2_error_html_template = self.read_templates(
["saml_error.html"], saml2_config.get("template_dir") ["saml_error.html"], saml2_config.get("template_dir"), autoescape=True
)[0] )[0]
def _default_saml_config_dict( def _default_saml_config_dict(