Hardening: escape map tooltips in JS, log migrations via logger, tidy Linux mount parsing

Aperta
  • Qualcosa non va?
#1,094 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
72/100
Tipo di issue
Refactoring
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
javascript, linux, python
Ambito
database, desktop-dev, operating-systems

Direzione di ricerca

Three independent hardening items, each with its own files. Start with the mechanical one: run grep -n 'print("Migration' src/opensak/db/database.py and switch those calls to logger.info. For the map tooltips, look at how gui/map_widget.py substitutes MAP_TIP_MAXIMIZE and MAP_TIP_POPOUT, and test with a patched tr() in test_map_widget.py. For the mount parsing, see _linux_mounts() and _is_removable_path(). Done means all three are fixed and each has its test passing.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

improvement

Small hardening items from an external code review, verified against beta (v1.22.0-beta.4). None of them is a user-visible bug today; each closes a latent trap.

1. Map tooltips are inserted unescaped into JavaScript string literals

gui/map_widget.py builds the map page with string replacement:

maxBtn.title = 'MAP_TIP_MAXIMIZE';
popBtn.title = 'MAP_TIP_POPOUT';
...
html = html.replace("MAP_TIP_MAXIMIZE", tr("toolbar_maximize_map_tooltip"))
html = html.replace("MAP_TIP_POPOUT", tr("toolbar_popout_map_tooltip"))

No current translation of these two keys contains ' or \, but a future translation that does (e.g. French with an apostrophe) would break the map's JavaScript. Data arguments already go through _js_arg() / json.dumps().

Fix: drop the surrounding quotes in the template (maxBtn.title = MAP_TIP_MAXIMIZE;) and replace with _js_arg(tr(...)) (or json.dumps(..., ensure_ascii=False)).
Test: in test_map_widget.py, patch tr() to return a string containing ', " and \ and assert the rendered HTML contains the correctly JSON-encoded literal.

2. Migrations use print() instead of the logger

db/database.py has 12 print("Migration: ...") calls. In windowed PyInstaller builds stdout may be invalid, and the messages never reach the app log, which is where we ask users to look.

Fix: replace with logger.info(...). Mechanical: grep -n 'print("Migration' src/opensak/db/database.py.

3. Linux mount parsing doesn't decode escaped paths

  • lsblk --raw escapes spaces and other characters as \xHH, and /proc/mounts escapes spaces as \040. _linux_mounts() (methods 1 and 2) and _is_removable_path() compare these encoded strings directly with real paths.
  • In practice this is harmless: _is_removable_path() short-circuits on /media/, /run/media/ and /mnt/, and method 3 scans those directories directly, so devices with spaces in their names are still found. Only mounts outside those prefixes are affected.

Fix (optional, cheap): switch both lsblk calls to lsblk --json --output MOUNTPOINT,RM (util-linux ≥ 2.27, 2015), and decode \040 etc. in the /proc/mounts fallback. Add a test with a mountpoint containing a space.

Lingua principale
Python
Stelle
37
Fork
17
Merge medio
21h 5m
PR unite (30g)
131

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di OpenSAK-Org/OpenSAK

Tutte le issue di OpenSAK-Org/OpenSAK

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.