<commit_before>from raggregate import queries
from raggregate.models import User

import sqlahelper

import datetime
import uuid
import os

import queries

from pyramid.url import static_url
from pyramid import httpexceptions

from raggregate import template_filters

dbsession = sqlahelper.get_session()

def ban(event):
    r = event.request
    ip_ban = queries.list_bans(ip = r.remote_addr)

    if 'logged_in' in r.session:
        username_ban = queries.list_bans(username = queries.get_user_by_id(r.session['users.id']).name)
    else:
        username_ban = False

    if ip_ban or username_ban:
        raise httpexceptions.HTTPForbidden

def clean_inputs(event):
    request = event.request
    safe_post = {}
    safe_params = {}
    safe_get = {}

    if request.POST:
        p = request.POST
        for i in p.items():
            if i[0] != 'body' and i[0] != 'description' and i[0] != 'description-textarea':
                safe_i = queries.strip_all_html(i[1])
                safe_post[i[0]] = safe_i
            else:
                safe_post[i[0]] = i[1]
    if request.GET:
        get = request.GET
        for i in get.items():
            safe_i = queries.strip_all_html(i[1])
            safe_get[i[0]] = safe_i

    request.session['safe_get'] = safe_get
    request.session['safe_post'] = safe_post
    request.session['safe_params'] = dict(safe_get.items() + safe_post.items())

    return 0<commit_msg>Do not add cgi.FieldStorage objects to safe_* session variables. ...<commit_after>from raggregate import queries
from raggregate.models import User

import sqlahelper

import datetime
import uuid
import os

import queries

from pyramid.url import static_url
from pyramid import httpexceptions

from raggregate import template_filters

import cgi

dbsession = sqlahelper.get_session()

def ban(event):
    r = event.request
    ip_ban = queries.list_bans(ip = r.remote_addr)

    if 'logged_in' in r.session:
        username_ban = queries.list_bans(username = queries.get_user_by_id(r.session['users.id']).name)
    else:
        username_ban = False

    if ip_ban or username_ban:
        raise httpexceptions.HTTPForbidden

def clean_inputs(event):
    request = event.request
    safe_post = {}
    safe_params = {}
    safe_get = {}

    if request.POST:
        p = request.POST
        for i in p.items():
            # i[0] is field name, i[1] is actual object
            # do NOT do anything to FieldStorage (POST'd files)
            # attempting to add them to this variable results in
            # pickling error, cgi.FieldStorage does not define
            # __getstate__ apparently.
            # access any posted files directly via request.POST
            if isinstance(i[1], cgi.FieldStorage):
                continue

            if i[0] != 'body' and i[0] != 'description' and i[0] != 'description-textarea':
                safe_i = queries.strip_all_html(i[1])
                safe_post[i[0]] = safe_i
            else:
                safe_post[i[0]] = i[1]
    if request.GET:
        get = request.GET
        for i in get.items():
            safe_i = queries.strip_all_html(i[1])
            safe_get[i[0]] = safe_i

    request.session['safe_get'] = safe_get
    request.session['safe_post'] = safe_post
    request.session['safe_params'] = dict(safe_get.items() + safe_post.items())

    return 0
{'fraction_non_alphanumeric': 0.0984240261671127, 'fraction_numerical': 0.006839131727624145, 'mean_word_length': 2.552270327349525, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4979246', 'n_tokens_mistral': 1073, 'n_tokens_neox': 1035, 'n_words': 268}