Sanitize imported iCalendar/ICS HTML

apps/events/importer.py

@@ -8,6 +8,7 @@
 
 from apps.events.models import Event, EventLocation, OccurringRule
 from apps.events.utils import extract_date_or_datetime
+from pydotorg.markup import sanitize
 
 logger = logging.getLogger(__name__)
 
@@ -46,6 +47,7 @@ def import_event(self, event_data):
         uid = event_data["UID"]
         title = event_data["SUMMARY"]
         description = event_data.get("DESCRIPTION", "")
+        description = sanitize(description)
         location, _ = EventLocation.objects.get_or_create(calendar=self.calendar, name=event_data["LOCATION"])
         defaults = {
             "title": title,

apps/events/tests/test_importer.py

@@ -1,6 +1,7 @@
 from pathlib import Path
 
 from django.test import TestCase
+from django.urls import reverse
 from django.utils.timezone import datetime, make_aware
 
 from apps.events.importer import ICSImporter
@@ -150,3 +151,27 @@ def test_import_event_does_not_exclude_ending_day_when_all_day_is_false(self):
             make_aware(datetime(year=2013, month=8, day=2, hour=20, minute=30)),
             single_day_event.next_or_previous_time.dt_end,
         )
+
+    def test_import_event_escaped(self):
+        ical = """BEGIN:VCALENDAR
+BEGIN:VEVENT
+DTSTART;VALUE=DATE:20150328
+DTEND;VALUE=DATE:20150330
+DTSTAMP:20150202T092425Z
+UID:pythoncalendartest@python.org
+SUMMARY:<javascript:alert(1)>
+DESCRIPTION:<javascript:alert(1)>
+LOCATION:<javascript:alert(1)>
+END:VEVENT
+END:VCALENDAR
+"""
+        importer = ICSImporter(self.calendar)
+        importer.import_events_from_text(ical)
+
+        event = Event.objects.get(uid="pythoncalendartest@python.org")
+        url = reverse("events:event_detail", kwargs={"pk": event.pk, "calendar_slug": self.calendar.slug})
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 200)
+        event_page = response.content.decode()
+        self.assertIn("&lt;javascript:alert(1)&gt;", event_page)
+        self.assertNotIn("<javascript:alert(1)>", event_page)