Escape/encode URL for all eligible renderers

 - Eligibility: direct-to-wb and/or through-exporter
 - Renderers updated: audio, image, jsc3d, pdb, svg, video
 - Unoconv is not updated since it only makes and calls the renderer
 - Set warning logs default to True

Author: cslzchen

mfr/extensions/audio/render.py

@@ -3,6 +3,7 @@
 from mako.lookup import TemplateLookup
 
 from mfr.core import extension
+from mfr.extensions.utils import escape_url_for_template
 
 
 class AudioRenderer(extension.BaseRenderer):
@@ -13,7 +14,8 @@ class AudioRenderer(extension.BaseRenderer):
         ]).get_template('viewer.mako')
 
     def render(self):
-        return self.TEMPLATE.render(base=self.assets_url, url=self.url)
+        safe_url = escape_url_for_template(self.url)
+        return self.TEMPLATE.render(base=self.assets_url, url=safe_url)
 
     @property
     def file_required(self):

mfr/extensions/image/render.py

@@ -5,7 +5,7 @@
 
 from mfr.core import extension
 from mfr.extensions.image import settings
-from mfr.extensions.utils import munge_url_for_localdev
+from mfr.extensions.utils import munge_url_for_localdev, escape_url_for_template
 
 
 class ImageRenderer(extension.BaseRenderer):
@@ -19,7 +19,8 @@ def render(self):
         self.metrics.add('needs_export', False)
         if self.metadata.ext in settings.EXPORT_EXCLUSIONS:
             download_url = munge_url_for_localdev(self.url)
-            return self.TEMPLATE.render(base=self.assets_url, url=download_url.geturl())
+            safe_url = escape_url_for_template(download_url.geturl())
+            return self.TEMPLATE.render(base=self.assets_url, url=safe_url)
 
         exported_url = furl.furl(self.export_url)
         if settings.EXPORT_MAXIMUM_SIZE and settings.EXPORT_TYPE:
@@ -28,10 +29,12 @@ def render(self):
             exported_url.args['format'] = settings.EXPORT_TYPE
         else:
             download_url = munge_url_for_localdev(self.url)
-            return self.TEMPLATE.render(base=self.assets_url, url=download_url.geturl())
+            safe_url = escape_url_for_template(download_url.geturl())
+            return self.TEMPLATE.render(base=self.assets_url, url=safe_url)
 
         self.metrics.add('needs_export', True)
-        return self.TEMPLATE.render(base=self.assets_url, url=exported_url.url)
+        safe_url = escape_url_for_template(exported_url.url)
+        return self.TEMPLATE.render(base=self.assets_url, url=safe_url)
 
     @property
     def file_required(self):

mfr/extensions/jsc3d/render.py

@@ -7,7 +7,7 @@
 
 from mfr.core import extension
 from mfr.extensions.jsc3d import settings
-from mfr.extensions.utils import munge_url_for_localdev
+from mfr.extensions.utils import munge_url_for_localdev, escape_url_for_template
 
 
 class JSC3DRenderer(extension.BaseRenderer):
@@ -21,18 +21,20 @@ def render(self):
         self.metrics.add('needs_export', False)
         if self.metadata.ext in settings.EXPORT_EXCLUSIONS:
             download_url = munge_url_for_localdev(self.metadata.download_url)
+            safe_url = escape_url_for_template(download_url.geturl())
             return self.TEMPLATE.render(
                 base=self.assets_url,
-                url=download_url.geturl(),
+                url=safe_url,
                 ext=self.metadata.ext.lower(),
             )
 
         exported_url = furl.furl(self.export_url)
         exported_url.args['format'] = settings.EXPORT_TYPE
         self.metrics.add('needs_export', True)
+        safe_url = escape_url_for_template(exported_url.url)
         return self.TEMPLATE.render(
             base=self.assets_url,
-            url=exported_url.url,
+            url=safe_url,
             ext=settings.EXPORT_TYPE,
         )
 

mfr/extensions/pdb/render.py

@@ -6,7 +6,7 @@
 
 from mfr.core import extension
 from mfr.extensions.pdb import settings
-from mfr.extensions.utils import munge_url_for_localdev
+from mfr.extensions.utils import munge_url_for_localdev, escape_url_for_template
 
 
 class PdbRenderer(extension.BaseRenderer):
@@ -18,9 +18,10 @@ class PdbRenderer(extension.BaseRenderer):
 
     def render(self):
         download_url = munge_url_for_localdev(self.metadata.download_url)
+        safe_url = escape_url_for_template(download_url.geturl())
         return self.TEMPLATE.render(
             base=self.assets_url,
-            url=download_url.geturl(),
+            url=safe_url,
             options=json.dumps(settings.OPTIONS),
         )
 

mfr/extensions/svg/render.py

@@ -4,6 +4,7 @@
 from mako.lookup import TemplateLookup
 
 from mfr.core import extension
+from mfr.extensions.utils import escape_url_for_template
 
 
 class SvgRenderer(extension.BaseRenderer):
@@ -14,7 +15,8 @@ class SvgRenderer(extension.BaseRenderer):
         ]).get_template('viewer.mako')
 
     def render(self):
-        return self.TEMPLATE.render(base=self.assets_url, url=self.url)
+        safe_url = escape_url_for_template(self.url)
+        return self.TEMPLATE.render(base=self.assets_url, url=safe_url)
 
     @property
     def file_required(self):

mfr/extensions/utils.py

@@ -29,7 +29,7 @@ def munge_url_for_localdev(url: str) -> Tuple:
     return url_obj
 
 
-def escape_url_for_template(url: str, logs=False) -> str:
+def escape_url_for_template(url: str, logs: bool=True) -> str:
     """Escape (URL Encode) single and double quote(s) for the given URL.
 
     Download and export URLs may end up not properly encoded right before they are about to be sent

mfr/extensions/video/render.py

@@ -3,7 +3,7 @@
 from mako.lookup import TemplateLookup
 
 from mfr.core import extension
-from mfr.extensions.utils import munge_url_for_localdev
+from mfr.extensions.utils import munge_url_for_localdev, escape_url_for_template
 
 
 class VideoRenderer(extension.BaseRenderer):
@@ -15,7 +15,8 @@ class VideoRenderer(extension.BaseRenderer):
 
     def render(self):
         download_url = munge_url_for_localdev(self.metadata.download_url)
-        return self.TEMPLATE.render(url=download_url.geturl())
+        safe_url = escape_url_for_template(download_url.geturl())
+        return self.TEMPLATE.render(url=safe_url)
 
     @property
     def file_required(self):