Merge branch 'develop'

Author: vabene1111

cookbook/helper/template_helper.py

@@ -46,13 +46,19 @@ def _plural_name_tag(singular, plural_name, amount, no_amount):
     """
     if plural_name in (None, ""):
         return html.escape(singular)
+
+    try:
+        amount_val = float(amount)
+    except (ValueError, TypeError):
+        amount_val = 0.0
+
     return (
         f"<plural-name"
         f' singular="{html.escape(singular)}"'
         f' plural="{html.escape(plural_name)}"'
-        f" v-bind:amount='{float(amount)}'"
+        f" v-bind:amount='{amount_val}'"
         f" v-bind:factor='ingredient_factor'"
-        f" :no-amount='{str(no_amount).lower()}'"
+        f" :no-amount='{'true' if no_amount else 'false'}'"
         f"></plural-name>"
     )
 
@@ -68,8 +74,12 @@ def __init__(self, ingredient):
         if ingredient.no_amount:
             self.amount = ""
         else:
-            self.amount = f"<scalable-number v-bind:number='{bleach.clean(str(ingredient.amount))}' v-bind:factor='ingredient_factor'></scalable-number>"
-            self.numeric_amount = float(ingredient.amount)
+            try:
+                amount_val = float(ingredient.amount)
+            except (ValueError, TypeError):
+                amount_val = 0.0
+            self.amount = f"<scalable-number v-bind:number='{amount_val}' v-bind:factor='ingredient_factor'></scalable-number>"
+            self.numeric_amount = amount_val
         self.unit = bleach.clean(_resolve_unit_name(ingredient))
         if ingredient.food:
             if ingredient.food.plural_name in (None, ""):
@@ -95,7 +105,7 @@ def __str__(self):
 def render_instructions(step):  # TODO deduplicate markdown cleanup code
     instructions = step.instruction
 
-    tags = {
+    allowed_tags = [
         "h1", "h2", "h3", "h4", "h5", "h6",
         "b", "i", "strong", "em", "tt",
         "p", "br",
@@ -105,33 +115,43 @@ def render_instructions(step):  # TODO deduplicate markdown cleanup code
         "a",
         "sub", "sup",
         'pre', 'table', 'td', 'tr', 'th', 'tbody', 'thead',
-        'scalable-number',
+    ]
+
+    allowed_attributes = {
+        "*": ["id", "class", 'width', 'height'],
+        "img": ["src", "alt", "title"],
+        "a": ["href", "alt", "title"],
     }
-    parsed_md = md.markdown(
+
+    # do a first, strict round of cleaning
+    instructions = bleach.clean(instructions, allowed_tags, allowed_attributes)
+
+    # parse markdown
+    instructions = md.markdown(
         instructions,
         extensions=[
             'markdown.extensions.fenced_code', 'markdown.extensions.sane_lists', 'markdown.extensions.nl2br', TableExtension(),
             UrlizeExtension(), MarkdownFormatExtension()
         ]
     )
-    markdown_attrs = {
-        "*": ["id", "class", 'width', 'height'],
-        "img": ["src", "alt", "title"],
-        "a": ["href", "alt", "title"],
-        "scalable-number": ["v-bind:number", "v-bind:factor"]
-    }
 
+    # prepare template context
     ingredients = []
 
     for i in step.ingredients.all():
         ingredients.append(IngredientObject(i))
 
     def scale(number):
-        return f"<scalable-number v-bind:number='{bleach.clean(str(number))}' v-bind:factor='ingredient_factor'></scalable-number>"
+        try:
+            number_val = float(number)
+        except (ValueError, TypeError):
+            number_val = 0.0
+        return f"<scalable-number v-bind:number='{number_val}' v-bind:factor='ingredient_factor'></scalable-number>"
 
+    # compile template
     try:
         env = SandboxedEnvironment()
-        instructions = env.from_string(parsed_md).render(ingredients=ingredients, scale=scale)
+        instructions = env.from_string(instructions).render(ingredients=ingredients, scale=scale)
     except TemplateSyntaxError:
         return _('Could not parse template code.') + ' Error: Template Syntax broken'
     except TypeError:
@@ -143,8 +163,42 @@ def scale(number):
     except Exception as e:
         return _('Could not parse template code.') + f' Error generating template.'
 
-    instructions = bleach.clean(instructions, tags, markdown_attrs)
-
+    # do second cleaning that allows scalable-number
+    def validate_scalable_number_attributes(tag, name, value):
+        if name == 'v-bind:number':
+            try:
+                float(value)
+                return True
+            except (ValueError, TypeError):
+                return False
+        if name == 'v-bind:factor':
+            return value == 'ingredient_factor'
+        return False
+
+    def validate_plural_name_attributes(tag, name, value):
+        if name == 'v-bind:amount':
+            try:
+                float(value)
+                return True
+            except (ValueError, TypeError):
+                return False
+        if name == 'v-bind:factor':
+            return value == 'ingredient_factor'
+        if name == ':no-amount':
+            return value == 'true' or value == 'false'
+        if name in ["singular", "plural", ]:
+            return True
+        return False
+
+    allowed_attributes["scalable-number"] = validate_scalable_number_attributes
+    allowed_attributes["plural-name"] = validate_plural_name_attributes
+
+    allowed_tags.append('scalable-number')
+    allowed_tags.append('plural-name')
+
+    instructions = bleach.clean(instructions, allowed_tags, allowed_attributes)
+
+    # remove any left over { }
     instructions = instructions.replace('{','')
     instructions = instructions.replace('}','')