Issue 3402 - Properly handle nested inline tags

cms/converters.py

Index: cms/converters.py
diff --git a/cms/converters.py b/cms/converters.py
index 1ab7ec3efcbc13c59c2efe6f4c8d67b280d61edb..2fe2b137fd9ee5b46b39765cc56dc714714b8de2 100644
--- a/cms/converters.py
+++ b/cms/converters.py
@@ -181,11 +181,16 @@ class Converter:
       )
 
     for tag in self.whitelist:
+      allowed_tags = [t % re.escape(tag_name)
+                      for t in ("\<%s[^<>]*?\>", "\<\/%s\>")

[Sebastian Noack, 2016/01/21 13:55:56]

Nit: None of your escaping applies to regexp as you don't use double backslashes
or  r"..". However, that shows that escaping isn't even necessary here.

Nit: You could simplify the surrounding Python code if you use a single regexp:
"<(?:%s[^<>]*?|/%s)>"

[kzar, 2016/02/19 14:32:28]

Done.

+                      for tag_name in self.whitelist.difference({tag})]

[Sebastian Noack, 2016/01/21 13:55:56]

Nit: self.whitelist - {tag}

Besides being more concise, it's probably also easier to understand as it's
clear that arithmetic semantics apply and you don't wonder whether
Set.difference() is some symmetric operation.

[kzar, 2016/02/19 14:32:28]

Done.

+      allowed_contents = "(?:%s)" % "|".join(["[^<>]"] + allowed_tags)
       saved = saved_attributes.get(tag, [])
       for attrs in saved:
         attrs = map(stringify_attribute, attrs)
         result = re.sub(
-          r"%s([^<>]*?)%s" % (re_escape("<%s>" % tag), re_escape("</%s>" % tag)),
+          r"%s(%s*?)%s" % (re_escape("<%s>" % tag), allowed_contents,

[Sebastian Noack, 2016/01/21 13:55:56]

I wonder whether you should parse the content recursively to make sure that tags
are closed correctly.

[kzar, 2016/02/19 14:32:28]

I guess so but probably overkill, we didn't check that before.

+                           re_escape("</%s>" % tag)),
           lambda match: r'<%s%s>%s</%s>' % (
             tag,
             " " + " ".join(attrs) if attrs else "",
@@ -195,7 +200,8 @@ class Converter:
           result, 1, flags=re.S
         )
       result = re.sub(
-        r"%s([^<>]*?)%s" % (re_escape("<%s>" % tag), re_escape("</%s>" % tag)),
+        r"%s(%s*?)%s" % (re_escape("<%s>" % tag), allowed_contents,
+                         re_escape("</%s>" % tag)),
         r"<%s>\1</%s>" % (tag, tag),
         result, flags=re.S
       )