Merge pull request #4400 from gratipay/rtlo

Add rtlo_scrub()
gratipay · Jun 16, 2017 · 9751637 · 9751637
2 parents f7b9166 + 0aeb172
commit 9751637
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/gratipay/utils/markdown.py b/gratipay/utils/markdown.py
@@ -23,4 +23,8 @@ def render_and_scrub(markdown):
     """Given markdown, return a Markup with tags stripped and everything else
     escaped.
     """
-    return Markup.escape(render(markdown).striptags())
+    u_right_to_left_override = "\u202E"
+    right_to_left_override = "&#8238;"
+    replacements = (right_to_left_override, ''), (u_right_to_left_override, '')
+    rtlo_gone = reduce(lambda a, kv: a.replace(*kv), replacements, markdown)
+    return Markup.escape(render(rtlo_gone).striptags())
diff --git a/tests/py/test_markdown.py b/tests/py/test_markdown.py
@@ -81,6 +81,9 @@ def test_scrubs_comments(self):
     def test_renders_entity_references(self):
         assert markdown.render_and_scrub('&trade;') == '\u2122'
 
+    def test_scrubs_rtlo(self):
+        assert markdown.render_and_scrub('ed.io/about&#8238;3p\u202Em.exe') == 'ed.io/about3pm.exe'
+
     def test_render_does_not_render_entity_references_it_really_is_striptags(self):
         assert markdown.render('&trade;') == '<p>&trade;</p>\n'
         assert markdown.render_and_scrub('&trade;') == '\u2122'