switch from cgi.escape to html.escape

MANIFEST.in

@@ -1,3 +1,3 @@
 include LICENSE README.md
-recursive-include docs *
-recursive-include misc *
+recursive-include pyquarantine/docs *
+recursive-include pyquarantine/misc *

pyquarantine/__init__.py

@@ -17,6 +17,7 @@ import configparser
 import logging
 import os
 import re
+import encodings
 
 from Milter.utils import parse_addr
 from collections import defaultdict
@@ -31,6 +32,7 @@ from pyquarantine import storages
 from pyquarantine import whitelists
 
 __all__ = [
+    "make_header",
     "Quarantine",
     "QuarantineMilter",
     "setup_milter",
@@ -40,9 +42,25 @@ __all__ = [
     "notifications",
     "storages",
     "run",
-    "version",
     "whitelists"]
 
+__version__ = "1.0.8"
+
+
+################################################
+#  add charset alias for windows-874 encoding  #
+################################################
+
+aliases = encodings.aliases.aliases
+
+for alias in ["windows-874", "windows_874"]:
+    if alias not in aliases:
+        aliases[alias] = "cp874"
+
+setattr(encodings.aliases, "aliases", aliases)
+
+################################################
+
 
 def make_header(decoded_seq, maxlinelen=None, header_name=None,
                 continuation_ws=' ', errors='strict'):
@@ -342,7 +360,7 @@ class QuarantineMilter(Milter.Base):
             if quarantine.host_in_whitelist(hostaddr):
                 self.logger.debug(
                     f"host {hostaddr[0]} is in whitelist of "
-                    f"quarantine {quarantine['name']}")
+                    f"quarantine {quarantine.name}")
                 self.quarantines.remove(quarantine)
                 if not self.quarantines:
                     self.logger.debug(
@@ -384,7 +402,8 @@ class QuarantineMilter(Milter.Base):
             # write email header to memory buffer
             self.fp.write(f"{name}: {value}\r\n".encode(
                 encoding="ascii", errors="replace"))
-            value = str(make_header(decode_header(value), errors="replace"))
+            header = make_header(decode_header(value), errors="replace")
+            value = str(header).replace("\x00", "")
             self.logger.debug(
                 f"{self.qid}: decoded header: {name}: {value}")
             self.headers.append((name, value))

pyquarantine/cli.py

@@ -21,14 +21,14 @@ import sys
 import time
 
 from pyquarantine import QuarantineMilter, setup_milter
-from pyquarantine.version import __version__ as version
+from pyquarantine import __version__ as version
 
 
 def _get_quarantine(quarantines, name):
     try:
         quarantine = next((q for q in quarantines if q.name == name))
     except StopIteration:
-        raise RuntimeError(f"invalid quarantine 'name'")
+        raise RuntimeError("invalid quarantine 'name'")
     return quarantine
 
 

pyquarantine/notifications.py

@@ -17,12 +17,12 @@ import logging
 import re
 
 from bs4 import BeautifulSoup
-from cgi import escape
 from collections import defaultdict
 from email.policy import default as default_policy
 from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
 from email.mime.image import MIMEImage
+from html import escape
 from os.path import basename
 from urllib.parse import quote
 
@@ -212,7 +212,7 @@ class EMailNotification(BaseNotification):
                 raise RuntimeError(f"error reading image: {e}")
             else:
                 filename = basename(img_path)
-                img.add_header(f"Content-ID", f"<{filename}>")
+                img.add_header("Content-ID", f"<{filename}>")
                 self.embedded_imgs.append(img)
 
     def get_email_body_soup(self, qid, msg):
@@ -244,7 +244,8 @@ class EMailNotification(BaseNotification):
                     f"{qid}: content type is {content_type}, "
                     f"converting to text/html")
                 content = re.sub(r"^(.*)$", r"\1<br/>",
-                                 escape(content), flags=re.MULTILINE)
+                                 escape(content, quote=False),
+                                 flags=re.MULTILINE)
             else:
                 self.logger.debug(
                     f"{qid}: content type is {content_type}")
@@ -353,22 +354,24 @@ class EMailNotification(BaseNotification):
             variables = defaultdict(
                     str,
                     EMAIL_HTML_TEXT=sanitized_text,
-                    EMAIL_FROM=escape(headers["from"]),
-                    EMAIL_ENVELOPE_FROM=escape(mailfrom),
-                    EMAIL_ENVELOPE_FROM_URL=escape(quote(mailfrom)),
-                    EMAIL_TO=escape(headers["to"]),
-                    EMAIL_ENVELOPE_TO=escape(recipient),
+                    EMAIL_FROM=escape(headers["from"], quote=False),
+                    EMAIL_ENVELOPE_FROM=escape(mailfrom, quote=False),
+                    EMAIL_ENVELOPE_FROM_URL=escape(quote(mailfrom),
+                                                   quote=False),
+                    EMAIL_TO=escape(headers["to"], quote=False),
+                    EMAIL_ENVELOPE_TO=escape(recipient, quote=False),
                     EMAIL_ENVELOPE_TO_URL=escape(quote(recipient)),
-                    EMAIL_SUBJECT=escape(headers["subject"]),
+                    EMAIL_SUBJECT=escape(headers["subject"], quote=False),
                     EMAIL_QUARANTINE_ID=storage_id)
 
             if subgroups:
                 number = 0
                 for subgroup in subgroups:
-                    variables[f"SUBGROUP_{number}"] = escape(subgroup)
+                    variables[f"SUBGROUP_{number}"] = escape(subgroup,
+                                                             quote=False)
             if named_subgroups:
                 for key, value in named_subgroups.items():
-                    named_subgroups[key] = escape(value)
+                    named_subgroups[key] = escape(value, quote=False)
                 variables.update(named_subgroups)
 
             # parse template

pyquarantine/run.py

@@ -22,7 +22,7 @@ import sys
 
 import pyquarantine
 
-from pyquarantine.version import __version__ as version
+from pyquarantine import __version__ as version
 
 
 def main():

pyquarantine/version.py

@@ -1 +0,0 @@
-__version__ = "1.0.4"

setup.cfg

@@ -0,0 +1,2 @@
+[metadata]
+version = attr: pyquarantine.__version__

setup.py

@@ -4,11 +4,8 @@ def read_file(fname):
     with open(fname, 'r') as f:
         return f.read()
 
-version = {}
-exec(read_file("pyquarantine/version.py"), version)
 
 setup(name = "pyquarantine",
-    version = version["__version__"],
     author = "Thomas Oettli",
     author_email = "spacefreak@noop.ch",
     description = "A pymilter based sendmail/postfix pre-queue filter.",