Security fixes for library/ (SACGF/variantgrid_private#3833)

library/preview_request.py

@@ -223,7 +223,7 @@ def for_object(
             try:
                 internal_url = obj.get_absolute_url()
             except NoReverseMatch:
-                internal_url = "javascript:alert('Could not load a view for this type of result')"
+                internal_url = None
 
         if genome_builds is None:
             if hasattr(obj, "genome_build") and (genome_build := obj.genome_build):

library/utils/database_utils.py

@@ -126,7 +126,7 @@ def sql_delete_qs(qs, batch_size: Optional[int] = None) -> int:
     pk_qs = qs.values_list("pk", flat=True)
     meta = qs.model._meta
     if batch_size:
-        limit = f"LIMIT {batch_size}"
+        limit = f"LIMIT {int(batch_size)}"
     else:
         limit = ""
 

library/utils/diff_utils.py

@@ -189,7 +189,7 @@ def html(self):
         #     return SafeString(f"<span class='diff-text'>{escape(self.input.text)}</span>")
         # else:
         return SafeString("<span class='diff-text'>" + "".join(
-            f"<span class='diff-text-{diff.operation_name}'>{escape(diff.text)}</span>" for diff in self.diffs
+            f"<span class='diff-text-{escape(diff.operation_name)}'>{escape(diff.text)}</span>" for diff in self.diffs
         ) + "</span>")
 
     def append(self, op: str, segment: str) -> 'MultiDiffOutput':

library/utils/file_utils.py

@@ -144,7 +144,7 @@ def add_permissions_to_file(filename: str, add_stat: int):
     try:
         os.chmod(filename, st.st_mode | add_stat)
     except Exception as e:
-        logging.error("Path '%s' stat is %s", filename, st)
+        logging.debug("Path '%s' stat is %s", filename, st)
         raise e
 
 

library/utils/html_utils.py

@@ -1,11 +1,10 @@
-import html
 import re
 import uuid
 from html import escape
 from typing import Optional
 
 from bs4 import BeautifulSoup
-from django.utils.safestring import mark_safe, SafeString
+from django.utils.safestring import SafeString
 
 
 def html_id_safe(text: str) -> str:
@@ -22,12 +21,6 @@ def html_id_safe(text: str) -> str:
     return text
 
 
-def html_link(url: str, title: str) -> SafeString:
-    if not url:
-        return mark_safe(title)
-    return mark_safe(f"<a href='{url}'>{html.escape(title)}</a>")
-
-
 # note this tags expected in a single line of text
 # don't catch too many tags in case you get some false positives
 EXPECTED_HTML_TAGS_SINGLE_LINE = {'div', 'b', 'i', 'u', 'strong', 'em', 'sup', 'sub'}