Skip to content

Escape HTML entities in highlighted matches #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RedHeadSec wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Escape HTML entities in highlighted matches #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 9 additions & 8 deletions ldap_shell/completers/ad_object_completer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
from abc import abstractmethod
from ldap3 import SUBTREE
import threading
import html
from ldap_shell.utils import history
from ldap_shell.completers.base import ADObjectCacheManager

Expand Down Expand Up @@ -51,17 +52,17 @@ def get_completions(self, document: Document, complete_event, current_word=None)
)

def _highlight_match(self, text: str, substr: str) -> str:
"""Highlights the matching part of the text"""
"""Highlights the matching part of the text - escapes HTML entities"""
if not substr:
return text
return html.escape(text)

index = text.lower().find(substr.lower())
if index >= 0:
before = text[:index]
match = text[index:index + len(substr)]
after = text[index + len(substr):]
before = html.escape(text[:index])
match = html.escape(text[index:index + len(substr)])
after = html.escape(text[index + len(substr):])
return f"{before}<b><style fg='black'>{match}</style></b>{after}"
return text
return html.escape(text)

def _get_ad_objects(self):
objects = set()
Expand Down Expand Up @@ -129,4 +130,4 @@ class OUCompleter(ADObjectCompleter):
attributes = ['name', 'distinguishedName'] # Override attributes for OUs

def get_ldap_filter(self):
return "(objectClass=organizationalUnit)"
return "(objectClass=organizationalUnit)"