fixes #326 some html special chars where not escaped in diffs + code garden in helpers

rhodecode/lib/diffs.py

@@ -4,12 +4,12 b''
     ~~~~~~~~~~~~~~~~~~~
 
     Set of diffing helpers, previously part of vcs
-    
-    
+
+
     :created_on: Dec 4, 2011
     :author: marcink
     :copyright: (C) 2009-2011 Marcin Kuzminski <[e-mail]>
-    :original copyright: 2007-2008 by Armin Ronacher    
+    :original copyright: 2007-2008 by Armin Ronacher
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
@@ -30,15 +30,15 b' import difflib'
 
 from itertools import tee, imap
 
-from mercurial.match import match
-
 from vcs.exceptions import VCSError
 from vcs.nodes import FileNode
+import markupsafe
+
 
 def get_gitdiff(filenode_old, filenode_new, ignore_whitespace=True, context=3):
     """
     Returns git style diff between given ``filenode_old`` and ``filenode_new``.
-    
+
     :param ignore_whitespace: ignore whitespaces in diff
     """
 
@@ -95,7 +95,7 b' class DiffProcessor(object):'
             self.differ = self._highlight_line_udiff
 
     def escaper(self, string):
-        return string.replace('<', '&lt;').replace('>', '&gt;')
+        return markupsafe.escape(string)
 
     def copy_iterator(self):
         """
@@ -153,15 +153,15 b' class DiffProcessor(object):'
 
         raise Exception('wrong size of diff %s' % size)
 
-    def _highlight_line_difflib(self, line, next):
+    def _highlight_line_difflib(self, line, next_):
         """
         Highlight inline changes in both lines.
         """
 
         if line['action'] == 'del':
-            old, new = line, next
+            old, new = line, next_
         else:
-            old, new = next, line
+            old, new = next_, line
 
         oldwords = re.split(r'(\W)', old['line'])
         newwords = re.split(r'(\W)', new['line'])
@@ -183,17 +183,17 b' class DiffProcessor(object):'
         old['line'] = "".join(oldfragments)
         new['line'] = "".join(newfragments)
 
-    def _highlight_line_udiff(self, line, next):
+    def _highlight_line_udiff(self, line, next_):
         """
         Highlight inline changes in both lines.
         """
         start = 0
-        limit = min(len(line['line']), len(next['line']))
-        while start < limit and line['line'][start] == next['line'][start]:
+        limit = min(len(line['line']), len(next_['line']))
+        while start < limit and line['line'][start] == next_['line'][start]:
             start += 1
         end = -1
         limit -= start
-        while -end <= limit and line['line'][end] == next['line'][end]:
+        while -end <= limit and line['line'][end] == next_['line'][end]:
             end -= 1
         end += 1
         if start or end:
@@ -211,7 +211,7 b' class DiffProcessor(object):'
                     l['line'][last:]
                 )
             do(line)
-            do(next)
+            do(next_)
 
     def _parse_udiff(self):
         """
@@ -302,7 +302,7 b' class DiffProcessor(object):'
             pass
 
         # highlight inline changes
-        for file in files:
+        for _ in files:
             for chunk in chunks:
                 lineiter = iter(chunk)
                 #first = True

rhodecode/lib/helpers.py

@@ -214,13 +214,16 b' def pygmentize(filenode, **kwargs):'
     return literal(code_highlight(filenode.content,
                                   filenode.lexer, CodeHtmlFormatter(**kwargs)))
 
+
 def pygmentize_annotation(repo_name, filenode, **kwargs):
-    """pygmentize function for annotation
+    """
+    pygmentize function for annotation
 
     :param filenode:
     """
 
     color_dict = {}
+
     def gen_color(n=10000):
         """generator for getting n of evenly distributed colors using
         hsv color and golden ratio. It always return same order of colors
@@ -229,19 +232,26 b' def pygmentize_annotation(repo_name, fil'
         """
 
         def hsv_to_rgb(h, s, v):
-            if s == 0.0: return v, v, v
-            i = int(h * 6.0) # XXX assume int() truncates!
+            if s == 0.0:
+                return v, v, v
+            i = int(h * 6.0)  # XXX assume int() truncates!
             f = (h * 6.0) - i
             p = v * (1.0 - s)
             q = v * (1.0 - s * f)
             t = v * (1.0 - s * (1.0 - f))
             i = i % 6
-            if i == 0: return v, t, p
-            if i == 1: return q, v, p
-            if i == 2: return p, v, t
-            if i == 3: return p, q, v
-            if i == 4: return t, p, v
-            if i == 5: return v, p, q
+            if i == 0:
+                return v, t, p
+            if i == 1:
+                return q, v, p
+            if i == 2:
+                return p, v, t
+            if i == 3:
+                return p, q, v
+            if i == 4:
+                return t, p, v
+            if i == 5:
+                return v, p, q
 
         golden_ratio = 0.618033988749895
         h = 0.22717784590367374
@@ -251,12 +261,12 b' def pygmentize_annotation(repo_name, fil'
             h %= 1
             HSV_tuple = [h, 0.95, 0.95]
             RGB_tuple = hsv_to_rgb(*HSV_tuple)
-            yield map(lambda x:str(int(x * 256)), RGB_tuple)
+            yield map(lambda x: str(int(x * 256)), RGB_tuple)
 
     cgenerator = gen_color()
 
     def get_color_string(cs):
-        if color_dict.has_key(cs):
+        if cs in color_dict:
             col = color_dict[cs]
         else:
             col = color_dict[cs] = cgenerator.next()
@@ -291,6 +301,7 b' def pygmentize_annotation(repo_name, fil'
 
     return literal(annotate_highlight(filenode, url_func(repo_name), **kwargs))
 
+
 def is_following_repo(repo_name, user_id):
     from rhodecode.model.scm import ScmModel
     return ScmModel().is_following_repo(repo_name, user_id)
@@ -304,7 +315,7 b' from vcs.utils import author_name, autho'
 from rhodecode.lib import credentials_filter, age as _age
 from rhodecode.model.db import User
 
-age = lambda  x:_age(x)
+age = lambda  x: _age(x)
 capitalize = lambda x: x.capitalize()
 email = author_email
 short_id = lambda x: x[:12]
@@ -325,10 +336,11 b' def email_or_none(author):'
     # No valid email, not a valid user in the system, none!
     return None
 
+
 def person(author):
     # attr to return from fetched user
     person_getter = lambda usr: usr.username
-    
+
     # Valid email in the attribute passed, see if they're in the system
     _email = email(author)
     if _email != '':