fix: don't escape markdown fields

We already apply DOMPurify in frontend. Remove escape logic in backend
to avoid double escape input.

Author: Bogay

mongo/engine.py

@@ -42,11 +42,6 @@ def apply(cls):
     return decorator
 
 
-@handler(signals.pre_save)
-def escape_markdown(sender, document):
-    document.markdown = html.escape(document.markdown)
-
-
 class ZipField(FileField):
 
     def __init__(self, max_size=0, **ks):
@@ -172,7 +167,6 @@ def info(self):
         }
 
 
-@escape_markdown.apply
 class Homework(Document):
 
     homework_name = StringField(
@@ -263,26 +257,7 @@ class ProblemDescription(EmbeddedDocument):
         db_field='sampleOutput',
     )
 
-    def escape(self):
-        self.description, self.input, self.output, self.hint = (html.escape(
-            v or '') for v in (
-                self.description,
-                self.input,
-                self.output,
-                self.hint,
-            ))
-        _io = zip(self.sample_input, self.sample_output)
-        for i, (ip, op) in enumerate(_io):
-            self.sample_input[i] = ip or html.escape(ip)
-            self.sample_output[i] = op or html.escape(op)
-
-
-@handler(signals.pre_save)
-def problem_desc_escape(sender, document):
-    document.description.escape()
-
 
-@problem_desc_escape.apply
 class Problem(Document):
 
     class Visibility:
@@ -419,7 +394,6 @@ class Submission(Document):
     ip_addr = StringField(default=None, null=True)
 
 
-@escape_markdown.apply
 class Message(Document):
     timestamp = DateTimeField(default=datetime.now)
     sender = StringField(max_length=16, required=True)
@@ -429,7 +403,6 @@ class Message(Document):
     markdown = StringField(max_length=100000, required=True)
 
 
-@escape_markdown.apply
 class Announcement(Document):
     status = IntField(default=0, choices=[0, 1])  # not delete / delete
     title = StringField(max_length=64, required=True)
@@ -442,7 +415,6 @@ class Announcement(Document):
     pinned = BooleanField(default=False)
 
 
-@escape_markdown.apply
 class PostThread(Document):
     markdown = StringField(default='', required=True, max_length=100000)
     author = ReferenceField('User', db_field='author')

tests/test_mongo_engine.py

@@ -26,22 +26,3 @@ def test_not_in(self):
     def test_in(self):
         d = Duration()
         assert datetime.datetime.now() in d
-
-
-from mongo.engine import ProblemDescription
-
-
-class TestProblemDescription:
-
-    def test_escape(self):
-        pd = ProblemDescription()
-        pd.description = '<h1>description</h1>'
-        pd.input = 'input'
-        pd.output = 'output'
-        pd.hint = '<script>hint</script>'
-        pd.sample_input = ['123', '456']
-        pd.sample_output = ['789', '101']
-        pd.escape()
-        import html
-        assert pd.description == html.escape('<h1>description</h1>')
-        assert pd.hint == html.escape('<script>hint</script>')