HEX

File: //usr/lib/python3/dist-packages/trac/util/__pycache__/html.cpython-310.pyc
o

��eZ��@s�ddlZddlZddlZddlmZddlmZddlmZm	Z
zddlmZWne
y7ddlmZYnwzddlmZWne
yKdZYnwddlmZdd	lmZgd
�Zej��Zded<d]dd�Z	dd�Ze�d�Zd^dd�Zdd�ZdZdZdZe d_idd�dd�dd�dd�dd�d d�d!d�d"d�d#d�d$d�d%d�d&d�d'd�d(d�d)d�d*d�d+d�d,d�d-d�d.d�d/d�d0e�d1e�d2e�d3e�d4e��Z!de!d5<d6d7�Z"d8d9�Z#d:d;�Z$Gd<d=�d=e%�Z&Gd>d?�d?e&�Z'Gd@dA�dAe'�Z(GdBdC�dCe%�Z)e)�Z*GdDdE�dEe)�Z+e+�Z,ZGdFdG�dGe%�Z-GdHdI�dIe%�Z.GdJdK�dKe�Z/GdLdM�dMe/�Z0GdNdO�dOe/�Z1d]dPdQ�Z2d`dRdS�Z3dadTdU�Z4dVdW�Z5e6dXdY�e7dZ�D��Z8d[d\�Z9dS)b�N)�entities)�
HTMLParser)�Markup�escape)�soft_str)�soft_unicode)�	LazyProxy)�	TracError)�
to_unicode)�
Deuglifier�FormTokenInjector�TracHTMLSanitizerr�find_element�html�is_safe_origin�	plaintext�tag�to_fragment�
stripentities�	striptags�valid_html_bytes�unescape�'�aposTcCstt|t�r|St|t�rt|�St|�}|r&d|vr|Stt|��dd��Sd|vr,|Stt|��dd��dd��S)a3Create a Markup instance from a string and escape special characters
    it may contain (<, >, & and ").

    :param text: the string to escape; if not a string, it is assumed that
                 the input can be converted to a string
    :param quotes: if ``True``, double quote characters are escaped in
                   addition to the other special characters

    >>> escape('"1 < 2"')
    Markup('&#34;1 &lt; 2&#34;')

    >>> escape(['"1 < 2"'])
    Markup("['&#34;1 &lt; 2&#34;']")

    If the `quotes` parameter is set to `False`, the " character is left
    as is. Escaping quotes is generally only required for strings that are
    to be used in attribute values.

    >>> escape('"1 < 2"', quotes=False)
    Markup('"1 &lt; 2"')

    >>> escape(['"1 < 2"'], quotes=False)
    Markup('[\'"1 &lt; 2"\']')

    However, `escape` behaves slightly differently with `Markup` and
    `Fragment` behave instances, as they are passed through
    unmodified.

    >>> escape(Markup('"1 < 2 &#39;"'))
    Markup('"1 < 2 &#39;"')

    >>> escape(Markup('"1 < 2 &#39;"'), quotes=False)
    Markup('"1 < 2 &#39;"')

    >>> escape(tag.b('"1 < 2"'))
    Markup('<b>"1 &lt; 2"</b>')

    >>> escape(tag.b('"1 < 2"'), quotes=False)
    Markup('<b>"1 &lt; 2"</b>')

    :return: the escaped `Markup` string
    :rtype: `Markup`

    z&#39;�'z&#3z&#34;�")�
isinstancer�Fragment�
escape_quotes�str�replace)�text�quotes�e�r$�0/usr/lib/python3/dist-packages/trac/util/html.pyr3s
-
rcCs|sdSt|t�s|S|��S)aWReverse-escapes &, <, >, and " and returns a `str` object.

    >>> unescape(Markup('1 &lt; 2'))
    '1 < 2'

    If the provided `text` object is not a `Markup` instance, it is returned
    unchanged.

    >>> unescape('1 &lt; 2')
    '1 &lt; 2'

    :param text: the text to unescape
    :return: the unescsaped string
    :rtype: `str`
    �)rrr�r!r$r$r%rns

rz-&(?:#((?:\d+)|(?:[xX][0-9a-fA-F]+));?|(\w+);)Fcs*�fdd�}t|t�rt|�}t�||�S)u�Return a copy of the given text with any character or numeric entities
    replaced by the equivalent UTF-8 characters.

    >>> stripentities('1 &lt; 2')
    '1 < 2'
    >>> stripentities('more &hellip;')
    'more …'
    >>> stripentities('&#8230;')
    '…'
    >>> stripentities('&#x2026;')
    '…'
    >>> stripentities(Markup('…'))
    '…'

    If the `keepxmlentities` parameter is provided and is a truth value, the
    core XML entities (&amp;, &apos;, &gt;, &lt; and &quot;) are left intact.

    >>> stripentities('1 &lt; 2 &hellip;', keepxmlentities=True)
    '1 &lt; 2 …'

    :return: a `str` instance with entities removed
    :rtype: `str`
    cs�|�d�r%|�d�}|�d�rt|dd�d�}t|�St|d�}t|�S|�d�}�r4|dvr4d|Sztt|�WStyN�rJd|YS|YSw)	N�)�x�X��
�)�ampr�gt�lt�quotz&%s;z&amp;%s;)�group�
startswith�int�chr�_name2codepoint�KeyError)�match�ref��keepxmlentitiesr$r%�_replace_entity�s"



�
�z&stripentities.<locals>._replace_entity)rrr�_STRIPENTITIES_RE�sub)r!r;r<r$r:r%r�s
rcCst|���S)a�Return a copy of the text with any XML/HTML tags removed.

    >>> striptags('<span>Foo</span> bar')
    'Foo bar'
    >>> striptags('<span class="bar">Foo</span>')
    'Foo'
    >>> striptags('Foo<br />')
    'Foo'

    HTML/XML comments are stripped, too:

    >>> striptags('<!-- <blub>hehe</blah> -->test')
    'test'

    :param text: the string to remove tags from
    :return: a `str` instance with all tags removed
    :rtype: `str`
    )rrr'r$r$r%r�sr)�no�yes)�off�on)�false�true�	autofocus�autoplay�checked�controls�default�defer�disabled�formnovalidate�hidden�ismap�loop�multiple�muted�
novalidate�open�readonly�required�reversed�scoped�seamless�selected�contenteditable�	draggable�
spellcheck�	translate�autocomplete�asynccCs�|dkrt|t�rtdi|��pd}n<t|t�rt|�pd}n0|dkr6t|t�r/t|�p-d}n t|�p4d}n|tvrOt|}|durI|rF|nd}n|t|�}|durUdSt|�S)ajReturns the actual value for the attribute ``key``, for the given
    ``value``.

    This follows the rules described in the HTML5_ spec (Double-quoted
    attribute value syntax).

    .. _HTML5: https://www.w3.org/TR/html-markup/global-attributes.html#global-attributes

    In addition, it treats the ``'class'`` and the ``'style'``
    attributes in a special way, as it processes them through
    `classes` and `styles`.

    :rtype: a `Markup` object containing the escaped attribute value,
            but it can also be `None` to indicate that the attribute
            should be omitted from the output

    �classN�styler$)r�dict�classes�list�styles�SPECIAL_HTML_ATTRS�boolr)�key�val�valuesr$r$r%�html_attribute�s 

�
rkcs4ttd|��}|��fdd�t��D��d�|�S)aiHelper function for dynamically assembling a list of CSS class
    names in templates.

    Any positional arguments are added to the list of class names. All
    positional arguments must be strings:

    >>> classes('foo', 'bar')
    'foo bar'

    In addition, the names of any supplied keyword arguments are added
    if they have a truth value:

    >>> classes('foo', bar=True)
    'foo bar'
    >>> classes('foo', bar=False)
    'foo'
    >>> classes(foo=True, bar=True)
    'bar foo'

    If none of the arguments are added to the list, this function
    returns `''`:

    >>> classes(bar=False)
    ''

    Nc3s�|]	}�|r|VqdS�Nr$)�.0�k��kwargsr$r%�	<genexpr> s�zclasses.<locals>.<genexpr>� )rd�filter�extend�sorted�join)�argsrprcr$ror%rcs
rccOspi}g}td|�D]}t|t�r|�|�q	|�|�q	|�|�|�dd�t|��dd�d�D��d�|�S)a�Helper function for dynamically assembling a list of CSS style name
    and values in templates.

    Any positional arguments are added to the list of styles. All
    positional arguments must be strings or dicts:

    >>> styles('foo: bar', 'fu: baz', {'bottom-right': '1em'})
    'foo: bar; fu: baz; bottom-right: 1em'

    In addition, the names of any supplied keyword arguments are added
    if they have a string value:

    >>> styles('foo: bar', fu='baz')
    'foo: bar; fu: baz'
    >>> styles('foo: bar', bar=False)
    'foo: bar'

    If none of the arguments are added to the list, this function
    returns `''`:

    >>> styles(bar=False)
    ''

    Ncss$�|]
\}}|rd||fVqdS)z%s: %sNr$)rmrn�vr$r$r%rqDs
��zstyles.<locals>.<genexpr>cSs|dS)Nrr$)�ir$r$r%�<lambda>Eszstyles.<locals>.<lambda>)rh�; )	rsrrb�update�appendrtru�itemsrv)rwrp�dre�argr$r$r%re#s


�
rec@sLeZdZdZdZdd�Zdd�Zdd�Zd	d
�Zdd�Z	d
d�Z
dd�ZdS)rz8A fragment represents a sequence of strings or elements.)�childrencGsg|_|D]}|�|�qdSrl)r�r}��selfrwr�r$r$r%�__init__Os�zFragment.__init__cCstt|��Srl)rr�r�r$r$r%�__html__TszFragment.__html__cC�d�dd�|jD��S)Nr&css�|]}t|d�VqdS)FN�r�rm�cr$r$r%rqXs�z#Fragment.__str__.<locals>.<genexpr>�rvr�r�r$r$r%�__str__W�zFragment.__str__cCs
t||�Srl�r)r��otherr$r$r%�__add__Z�
zFragment.__add__cGs|D]}|�|�q|Srl)r}r�r$r$r%�__call__]szFragment.__call__cCs�|r2t|tttttf�r|j�|�dSz
|D]}|�|�qWdSty1|j�|�YdSw|dkr>|j�d�dSdS)Nr�0)	rrr�bytesr4�floatr�r}�	TypeError)r�r��eltr$r$r%r}bs���zFragment.appendcCr�)Nr&css*�|]}t|t�r
|��nt|�VqdSrl)rr�as_textrr�r$r$r%rqqs�"�z#Fragment.as_text.<locals>.<genexpr>r�r�r$r$r%r�ps
�zFragment.as_textN)�__name__�
__module__�__qualname__�__doc__�	__slots__r�r�r�r�r�r}r�r$r$r$r%rJsrc@sHeZdZdZdZiZdZdZdd�Zdd�Z	d	d
�Z
dd�Zd
d�ZdS)�
XMLElementzXAn element represents an XML element, with a tag name, attributes
    and content.

    )r�attribr$z/>cOs<tj|g|�R�t|�|_|r|�|�|_dS|j|_dSrl)rr�rr�_dict_from_kwargs�EMPTY_ATTRIBr�)r�rrwrpr$r$r%r��s
��zXMLElement.__init__cCs|Srlr$�r�rnrxr$r$r%�_attr_value��zXMLElement._attr_valuecCshg}|��D])\}}|dur/|dd�dkr|dd�}|�||�}|dur/|�|t|�f�qt|�S)N����_)r~r�r}rrb)r�rp�attrsrnrxr$r$r%r��s�zXMLElement._dict_from_kwargscOsD|r|�|�}|r|jr|j�|�n||_|D]}|�|�q|Srl)r�r�r|r})r�rwrprr�r$r$r%r��s
zXMLElement.__call__cCs�d|j}|jr+g}t|j�D]}|j|}|r!|�d||f�q|r+|d�|�7}|js7|jrI|j|jvrI|dt�|�d|jd7}|S||j	7}|S)N�<� %s="%s"r&�>�</)
rr�rur}rvr��
VOID_ELEMENTSrr��	CLOSE_TAG)r�r�r�rnrxr$r$r%r��s 

� 
�zXMLElement.__str__N)
r�r�r�r�r�r�r�r�r�r�r�r�r�r$r$r$r%r�usr�c@s(eZdZdZhd�ZdZdZdd�ZdS)�Elementz�An element represents an HTML element, with a tag name, attributes
    and content.

    Some elements and attributes are rendered specially, according to
    the HTML5 specification (or going there...)

    >�br�hr�col�img�wbr�area�base�link�meta�embed�input�param�track�keygen�source�commandz />r$cCs
t||�Srl)rkr�r$r$r%r��r�zElement._attr_valueN)r�r�r�r�r�r�r�r�r$r$r$r%r��sr�c@� eZdZdZdd�Zdd�ZdS)�XMLElementFactoryzhAn XML element factory can be used to build Fragments and
    XMLElements for arbitrary tag names.

    cGst|�Srlr�)r�rwr$r$r%r���zXMLElementFactory.__call__cC�t|�Srl)r��r�rr$r$r%�__getattr__�r�zXMLElementFactory.__getattr__N)r�r�r�r�r�r�r$r$r$r%r��sr�c@seZdZdZdd�ZdS)�ElementFactoryzaAn element factory can be used to build Fragments and Elements for
    arbitrary tag names.

    cCr�rl)r�r�r$r$r%r��r�zElementFactory.__getattr__N)r�r�r�r�r�r$r$r$r%r��sr�c@s�eZdZdZegd��Zegd��Zegd��Zegd��Zegd��Z	edg�Z
eeeee	e
fdd	�Ze�
d
�jZe�
d�jZdd
�Zdd�Zdd�Zdd�Zdd�Zdd�Ze�
d�jZe�
dej�jZdd�Zdd�Ze�
d�jZdd �Zd!S)"r
a�Sanitize HTML constructions which are potentially vector of
    phishing or XSS attacks, in user-supplied HTML.

    The usual way to use the sanitizer is to call the `sanitize`
    method on some potentially unsafe HTML content.

    See also `genshi.HTMLSanitizer`_ from which the TracHTMLSanitizer
    has evolved.

    .. _genshi.HTMLSanitizer:
       http://genshi.edgewall.org/wiki/Documentation/filters.html#html-sanitizer

    )G�a�abbr�acronym�addressr��b�big�
blockquoter��button�caption�center�cite�coder��colgroup�dd�del�dfn�dir�div�dl�dt�em�fieldset�font�form�h1�h2�h3�h4�h5�h6r�ryr�r��ins�kbd�label�legend�li�map�menu�ol�optgroup�option�p�pre�q�s�samp�select�small�span�strike�strongr>�sup�table�tbody�td�textarea�tfoot�th�thead�tr�tt�u�ul�var)Ir��acceptzaccept-charset�	accesskey�action�align�alt�axis�bgcolor�border�cellpadding�cellspacing�char�charoff�charsetrGr�r`�clear�cols�colspan�color�compact�coords�datetimer�rK�enctype�for�frame�headers�height�href�hreflang�hspace�idrNr��lang�longdesc�	maxlength�media�methodrP�name�nohref�noshade�nowrap�promptrT�rel�rev�rows�rowspan�rules�scoperY�shape�sizer��src�startra�summary�tabindex�target�title�type�usemap�valign�value�vspace�width)e�
backgroundzbackground-attachmentzbackground-colorzbackground-imagezbackground-positionzbackground-repeatrz
border-bottomzborder-bottom-colorzborder-bottom-stylezborder-bottom-left-radiuszborder-bottom-right-radiuszborder-bottom-widthzborder-collapsezborder-colorzborder-leftzborder-left-colorzborder-left-stylezborder-left-widthz
border-radiuszborder-rightzborder-right-colorzborder-right-stylezborder-right-widthzborder-spacingzborder-stylez
border-topzborder-top-colorzborder-top-left-radiuszborder-top-right-radiuszborder-top-stylezborder-top-widthzborder-width�bottomzcaption-sider�clipr�contentzcounter-incrementz
counter-reset�cursor�	direction�displayzempty-cellsr�r�zfont-familyz	font-sizez
font-stylezfont-variantzfont-weightr�leftzletter-spacingzline-heightz
list-stylezlist-style-imagezlist-style-positionzlist-style-type�marginz
margin-bottomzmargin-leftzmargin-rightz
margin-topz
max-heightz	max-widthz
min-heightz	min-width�opacity�orphans�outlinez
outline-colorz
outline-stylez
outline-width�overflow�paddingzpadding-bottomzpadding-leftz
padding-rightzpadding-topzpage-break-afterzpage-break-beforezpage-break-inside�positionr"�rightztable-layoutz
text-alignztext-decorationztext-indentztext-transform�topzunicode-bidizvertical-align�
visibilityzwhite-space�widowsr?zword-spacingzz-index)�file�ftp�http�https�mailtoN)rr@�dynsrcr�lowsrcr4zdata:cCs(||_||_||_||_||_||_dS)zyNote: safe_schemes and safe_css have to remain the first
        parameters, for backward-compatibility purpose.
        N)�	safe_tags�
safe_attrs�safe_css�	uri_attrs�safe_schemes�safe_origins)r�r^r\rZr[r]r_r$r$r%r�3s
zTracHTMLSanitizer.__init__uc[eEＥｅ][xXＸｘ][pPＰｐ][rRʀＲｒ][eEＥｅ][sSＳｓ]{2}[iIɪＩｉ][oOＯｏ][nNɴＮｎ]u[Uu][Rrʀ][Llʟ]\s*\(([^)]+)cCs.t|t���}|�|�|��t|j���S)z�Transforms the incoming HTML by removing anything's that deemed
        unsafe.

        :param html: the input HTML
        :type: str
        :return: the sanitized content
        :rtype: Markup

        )�HTMLSanitization�io�StringIO�feed�closer�out�getvalue)r�r�	transformr$r$r%�sanitizeds

zTracHTMLSanitizer.sanitizecCs8||jvrdS|dkr|��dkS|�d�rd|vSdS)z|Determine whether the given css property declaration is to be
        considered safe for inclusion in the output.

        FrN�staticrH�-T)r\�lowerr3)r��propr=r$r$r%�is_safe_cssss

zTracHTMLSanitizer.is_safe_csscCs&||jvrdS|dkrd|vrdSdS)aODetermine whether the given element should be considered safe for
        inclusion in the output.

        :param tag: the tag name of the element
        :type tag: str
        :param attrs: the element attributes
        :type attrs: list
        :return: whether the element should be considered safe
        :rtype: bool

        Fr�)r:�passwordT)rZ�r�rr�r$r$r%�is_safe_elem�s

zTracHTMLSanitizer.is_safe_elemcCsRd|vr|�dd�d}d|vrdSdd�|�dd�dD�}d�|���|jvS)	a:Determine whether the given URI is to be considered safe for
        inclusion in the output.

        The default implementation checks whether the scheme of the URI is in
        the set of allowed URIs (`safe_schemes`).

        >>> sanitizer = TracHTMLSanitizer()
        >>> sanitizer.is_safe_uri('http://example.org/')
        True
        >>> sanitizer.is_safe_uri('javascript:alert(document.cookie)')
        False

        :param uri: the URI to check
        :return: `True` if the URI can be considered safe, `False` otherwise
        :rtype: `bool`

        �#r(r�:TcSsg|]}|��r|�qSr$)�isalnum)rmrr$r$r%�
<listcomp>�sz1TracHTMLSanitizer.is_safe_uri.<locals>.<listcomp>r&)�splitrvrkr^)r��uri�charsr$r$r%�is_safe_uri�szTracHTMLSanitizer.is_safe_uricCs�i}|��D]1\}}|dur|}||jvrq||jvr"|�|�s!qn|dkr3|�|�}|s.qd�|�}|||<q|dkrMd|vrM|�|d�sMd}d||<|S)a!Remove potentially dangerous attributes and sanitize the style
        attribute .

        :param tag: the tag name of the element
        :type attrs: dict corresponding to tag attributes
        :return: a dict containing only safe or sanitized attributes
        :rtype: dict

        Nrar{r�r4�crossorigin�	anonymous)r~r[r]rx�sanitize_cssrv�_is_safe_origin)r�rr��	new_attrs�attrr=�declsr$r$r%�sanitize_attrs�s,



�


�z TracHTMLSanitizer.sanitize_attrsc	s�g}����|��}td|�d��D]D}|��}|sqz
|�dd�\}}Wn	ty.Yqw��|����|���s<q��|�sVt	�fdd���
|�D��rV|�|���q|S)a�Remove potentially dangerous property declarations from CSS code.

        In particular, properties using the CSS ``url()`` function
        with a scheme that is not considered safe are removed:

        >>> sanitizer = TracHTMLSanitizer()
        >>> sanitizer.sanitize_css('''
        ...   background: url(javascript:alert("foo"));
        ...   color: #000;
        ... ''')
        ['color: #000']

        Also, the proprietary Internet Explorer function
        ``expression()`` is always stripped:

        >>> sanitizer.sanitize_css('''
        ...   background: #fff;
        ...   color: #000;
        ...   width: e/**/xpression(alert("F"));
        ... ''')
        ['background: #fff', 'color: #000', 'width: e xpression(alert("F"))']

        :param text: the CSS text; this is expected to be `str` and to not
                     contain any character or numeric references
        :return: a list of declarations that are considered safe
        :rtype: `list`

        N�;rrr(c3s �|]}��|�d��VqdS)r(N)r|r2)rmr8r�r$r%rq�s��z1TracHTMLSanitizer.sanitize_css.<locals>.<genexpr>)�_strip_css_comments�_replace_unicode_escapesrsru�strip�
ValueErrorrmrk�_EXPRESSION_SEARCH�all�
_URL_FINDITERr})r�r!r�declrlr=r$r�r%r{�s*�
���zTracHTMLSanitizer.sanitize_cssz\r\nz8\\([0-9a-fA-F]{1,6})\s?|\\([^\r\n\f0-9a-fA-F'"{};:()#*])cCs|�|�o
t|j|�Srl)rxrr_)r�rvr$r$r%r|s

�z!TracHTMLSanitizer._is_safe_origincCsdd�}|�||�d|��S)NcSsZ|�d�}|r t|d�}t|�}|dkrd}|S|dkrd}|S|�d�}|dkr+dS|S)Nr(r+�rr�\z\\r-)r2r4r5)r8�tr�r�r$r$r%�_repls

�
z9TracHTMLSanitizer._replace_unicode_escapes.<locals>._repl�
)�_UNICODE_ESCAPE�_NORMALIZE_NEWLINES)r�r!r�r$r$r%r�s
�z*TracHTMLSanitizer._replace_unicode_escapesz	/\*.*?\*/cCs|�d|�S)z�Replace comments with space character instead of superclass which
        removes comments to avoid problems when nested comments.
        rr)�
_CSS_COMMENTS)r�r!r$r$r%r�sz%TracHTMLSanitizer._strip_css_commentsN) r�r�r�r��	frozenset�	SAFE_TAGS�
SAFE_ATTRS�SAFE_CSS�SAFE_SCHEMES�	URI_ATTRS�SAFE_CROSS_ORIGINSr��re�compile�searchr��finditerr�rhrmrprxr�r{r>r��UNICODEr�r|r�r�r�r$r$r$r%r
�sN



�����!/��r
c@s(eZdZdZdd�Zdd�Zdd�ZdS)	ra�Help base class used for cleaning up HTML riddled with ``<FONT
    COLOR=...>`` tags and replace them with appropriate ``<span
    class="...">``.

    The subclass must define a `rules()` static method returning a
    list of regular expression fragments, each defining a capture
    group in which the name will be reused for the span's class. Two
    special group names, ``font`` and ``endfont`` are used to emit
    ``<span>`` and ``</span>``, respectively.

    cCs:t�|�}t|d�st�dd�|����|_|j|_|S)N�_compiled_rulesz(?:%s)�|)�object�__new__�hasattrr�r�rvr0r�)�clsr�r$r$r%r�0s


zDeuglifier.__new__cCst�|j|j|�Srl)r�r>r�r )r��indatar$r$r%�format7�zDeuglifier.formatcCsF|����D]\}}|r |dkrdS|dkrdSd|SqdS)Nr�z<span>�endfontz</span>z<span class="code-%s">)�	groupdictr~)r��	fullmatch�mtyper8r$r$r%r :s��zDeuglifier.replaceN)r�r�r�r�r�r�r r$r$r$r%r$s
rc@�XeZdZdZdd�Zdd�Zdd�Zdd	�Zd
d�Zdd
�Z	dd�Z
dd�Zdd�ZdS)�
HTMLTransformz�Convenience base class for writing HTMLParsers.

    The default implementation of the HTMLParser ``handle_*`` methods
    do nothing, while in our case we try to rewrite the incoming
    document unmodified.

    cCsRt�|�||_t|tj�rdd�|_dSt|tj�r"dd�|_dSdd�|_dS)NcS�t|t�r
|�d�S|S�Nzutf-8)rr��decode�rxr$r$r%rzQ��z(HTMLTransform.__init__.<locals>.<lambda>cSr�r�)rr�encoder�r$r$r%rzTr�cSs|Srlr$r�r$r$r%rzWs)rr�rerra�
TextIOBase�_convert�IOBase)r�rer$r$r%r�Ms
zHTMLTransform.__init__cC�|�|���dSrl��_write�get_starttag_textror$r$r%�handle_starttagYr�zHTMLTransform.handle_starttagcCr�rlr�ror$r$r%�handle_startendtag\r�z HTMLTransform.handle_startendtagcC�|�d|�dS)Nz	<!--%s-->�r��r��datar$r$r%�handle_comment_r�zHTMLTransform.handle_commentcCr��Nz<!%s>r�r�r$r$r%�handle_declbr�zHTMLTransform.handle_declcCr�)N�<?%s?>r�r�r$r$r%�	handle_pier�zHTMLTransform.handle_picCs|�|�dSrlr�r�r$r$r%�handle_datahszHTMLTransform.handle_datacCs|�d|d�dS�Nr�r�r�r�r$r$r%�
handle_endtagkr�zHTMLTransform.handle_endtagcCs|j�|�|��dSrl)re�writer�r�r$r$r%r�nr�zHTMLTransform._writeN)
r�r�r�r�r�r�r�r�r�r�r�r�r�r$r$r$r%r�Dsr�c@r�)rz�Identify and protect forms from CSRF attacks.

    This filter works by adding a input type=hidden field to POST
    forms.

    cCst�||�||_dSrl)r�r��token)r��
form_tokenrer$r$r%r�ys
zFormTokenInjector.__init__cCsZt�|||�|��dkr)|D]\}}|dkr(|��dkr(|�d|j�dSqdSdS)Nr�r&�postz5<input type="hidden" name="__FORM_TOKEN" value="%s"/>)r�r�rkr�r�)r�rr�r'r=r$r$r%r�}s���z!FormTokenInjector.handle_starttagN)r�r�r�r�r�r�r$r$r$r%rrsrc@r�)r`z-Sanitize parsed HTML using TracHTMLSanitizer.cCst�||�||_d|_dSrl)r�r��	sanitizer�waiting_for)r�r�rer$r$r%r��s
zHTMLSanitization.__init__csh|jrdS|j�||�s||_dS|j�|t|���d��fdd�t��D��}|�d|||f�dS)Nr&c3s$�|]
}d|t�|�fVqdS)r�Nr�)rmr'�r}r$r%rq�s��z1HTMLSanitization._handle_start.<locals>.<genexpr>z<%s%s%s>)r�r�rpr�rbrvrur�)r�rr��startend�
html_attrsr$r�r%�
_handle_start�s�zHTMLSanitization._handle_startcC�|js|�||d�dSdS)Nr&�r�r�ror$r$r%r����z HTMLSanitization.handle_starttagcCr��N�/r�ror$r$r%r��r�z#HTMLSanitization.handle_startendtagcCsdSrlr$r�r$r$r%r��r�zHTMLSanitization.handle_commentcCs|js|�d|�dSdSr��r�r�r�r$r$r%r��r�zHTMLSanitization.handle_declcCs$|js|�d|�dd��dSdS)Nr�z?>r&)r�r�r r�r$r$r%r��s�zHTMLSanitization.handle_picCs|js|�t|��dSdSrl)r�r�rr�r$r$r%r��r�zHTMLSanitization.handle_datacCs4|jr|j|kr
d|_dSdS|�d|d�dSr�r�r�r$r$r%r��s


�zHTMLSanitization.handle_endtagN)
r�r�r�r�r�r�r�r�r�r�r�r�r�r$r$r$r%r`�sr`cCs4t|t�r
|��}ntt|��}|s|�dd�}|S)a^Extract the text elements from (X)HTML content

    >>> plaintext('<b>1 &lt; 2</b>')
    '1 < 2'

    >>> plaintext(tag('1 ', tag.b('<'), ' 2'))
    '1 < 2'

    >>> plaintext('''<b>1
    ... &lt;
    ... 2</b>''', keeplinebreaks=False)
    '1 < 2'

    :param text: `unicode` or `Fragment`
    :param keeplinebreaks: optionally keep linebreaks

    r�rr)rrr�rrr )r!�keeplinebreaksr$r$r%r�s

rcCs�t|t�r,|dur||jvr|S|dur!||j�dd���vr!|S|dur,||jkr,|St|t�rF|jD]}t||||�}|durE|Sq4dSdS)z�Return the first element in the fragment having the given
    attribute, class or tag, using a preorder depth-first search.

    Nr`r&)	rr�r��getrurrr�r)�fragr~r�r�childr�r$r$r%r�s


��rcs�|rd|vr
|�d�s
dStdd�|D��rdS|�d�r&|r&d|j|f}t�d���fdd	�}||�}|D]+}||�}||krDdS|�d�rQ|�|�rQdS|�|�d
�rZ|n|d
�rbdSq7dS)z-Whether the given uri is a safe cross-origin.rrz//Tcss�|]}|dkVqdS)�*Nr$)rm�safer$r$r%rq�s�z!is_safe_origin.<locals>.<genexpr>z%s:%sz&(?:[a-zA-Z][-a-zA-Z0-9+._]*:)?//[^/]+$cs��|�r	|d7}|Sr�)r8)rv��normalize_rer$r%�
normalize_uri�s
z%is_safe_origin.<locals>.normalize_urir�F)r3�any�schemer�r��endswith)r_rv�reqr�r�r$r�r%r�s&
�rcCs|t|t�st|t�r't|j�dkr'|jd}t|t�st|t�r't|j�dkstr1t|t�r1|j}t|t�r8|Stt	|��S)z%Convert input to a `Fragment` object.r(r)
rr	�	Exception�lenrwrr=rrr
)r�r$r$r%rs
�

��
rccs�|]	}|dvr|VqdS))�	r,�
Nr$)rmryr$r$r%rqs���rq� cCs|�dt�S)z�Return only valid bytes in XML/HTML from the given data.

    >>> valid_html_bytes(b'blah')
    b'blah'

    >>> list(valid_html_bytes(bytes(range(33)) + b''))
    [9, 10, 13, 32, 127]

    N)r]�_invalid_control_chars)r�r$r$r%rs
r)T)Fr$)NNNrl):rar��sysrr�html.parserr�
markupsaferrrrr�ImportError�
babel.supportr�	trac.corer	�trac.util.textr
�__all__�name2codepoint�copyr6rr�r=rr�NO_YES�OFF_ON�
FALSE_TRUErbrfrkrcrer�rr�r�r��xmlr�rr
rr�rr`rrrrr��ranger�rr$r$r$r%�<module>s���

;

0��������������������������
%'+A
	B .
3