Validate HTML

.editorconfig

@@ -4,59 +4,38 @@
 
 root = true
 
-# Settings for IETF datatracker
+# Global settings for IETF datatracker
 # ---------------------------------------------------------
 # PEP8 Style
 
 [*]
-indent_style = space
 indent_size = 4
-end_of_line = lf
 charset = utf-8
-# to avoid tripping Henrik's commit hook:
-trim_trailing_whitespace = false
-insert_final_newline = false
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+# Specializations below *add to* the above defaults
 
 # Settings for .github folder
 # ---------------------------------------------------------
 # GitHub Markdown Style
 
 [.github/**]
-indent_style = space
 indent_size = 2
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = false
-insert_final_newline = true
 
 # Settings for client-side JS / Vue files
 # ---------------------------------------------------------
 # StandardJS Style
 
 [client/**]
-indent_style = space
 indent_size = 2
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
 
 [package.json]
-indent_style = space
 indent_size = 2
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
 
 # Settings for cypress tests
 # ---------------------------------------------------------
 # StandardJS Style
 
 [cypress/**]
-indent_style = space
 indent_size = 2
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true

.gitignore

@@ -14,6 +14,8 @@
 *.#*
 .*.swp
 .DS_store
+datatracker.sublime-project
+datatracker.sublime-workspace
 # Simulated Subversion default ignores end here
 /.coverage
 /.factoryboy_random_state

dev/tests/Dockerfile

@@ -24,7 +24,6 @@ RUN apt-get install -qy \
 	build-essential \
 	curl \
     docker-ce-cli \
-    default-jdk \
 	enscript \
 	gawk \
 	gcc \
@@ -46,7 +45,6 @@ RUN apt-get install -qy \
     libxtst6 \
 	libmagic-dev \
 	libmariadb-dev \
-	libtidy-dev \
 	locales \
 	mariadb-client \
     netcat \
@@ -109,9 +107,6 @@ RUN pip3 --disable-pip-version-check --no-cache-dir install -r /tmp/pip-tmp/requ
 # Turn off rsyslog kernel logging (doesn't work in Docker)
 RUN sed -i '/imklog/s/^/#/' /etc/rsyslog.conf
 
-# Install the Nu Html Checker (v.Nu)
-ADD https://github.com/validator/validator/releases/download/latest/vnu.jar /
-
 # Fetch wait-for utility
 ADD https://raw.githubusercontent.com/eficode/wait-for/v2.1.3/wait-for /usr/local/bin/
 RUN chmod +rx /usr/local/bin/wait-for

docker/app.Dockerfile

@@ -31,7 +31,6 @@ RUN apt-get install -qy \
 	bash \
 	build-essential \
 	curl \
-    default-jdk \
     docker-ce-cli \
 	enscript \
 	fish \
@@ -56,7 +55,6 @@ RUN apt-get install -qy \
 	libmagic-dev \
 	libmariadb-dev \
     libmemcached-tools \
-	libtidy-dev \
 	locales \
 	mariadb-client \
     memcached \
@@ -125,9 +123,6 @@ RUN sed -i '/imklog/s/^/#/' /etc/rsyslog.conf
 # Colorize the bash shell
 RUN sed -i 's/#force_color_prompt=/force_color_prompt=/' /root/.bashrc
 
-# Install the Nu Html Checker (v.Nu)
-ADD https://github.com/validator/validator/releases/download/latest/vnu.jar /
-
 ADD https://raw.githubusercontent.com/eficode/wait-for/v2.1.3/wait-for /usr/local/bin/
 RUN chmod +rx /usr/local/bin/wait-for
 

ietf/dbtemplate/templates/dbtemplate/template_show.html

@@ -33,8 +33,8 @@ <h2>Meta information</h2>
 
     <h2>Template content</h2>
 
-    <div class = "card">
-        <p class='pasted'>{{ template.content }}</p>
+    <div class="card">
+        <p class="pasted">{{ template.content }}</p>
     </div>
 
-{% endblock %}
+{% endblock %}

ietf/doc/templatetags/ballot_icon.py

@@ -109,14 +109,15 @@ def sort_key(t):
     else:
         typename = "IESG"
 
-    res = ['<a %s href="%s" data-bs-toggle="modal" data-bs-target="#modal-%d" title="%s positions (click to show more)" class="ballot-icon"><table' % (
+    res = ['<a %s href="%s" data-bs-toggle="modal" data-bs-target="#modal-%d" aria-label="%s positions" title="%s positions (click to show more)" class="ballot-icon"><table' % (
             right_click_string,
             urlreverse("ietf.doc.views_doc.ballot_popup", kwargs=dict(name=doc.name, ballot_id=ballot.pk)),
             ballot.pk,
+            typename,
             typename,)]
     if my_blocking:
         res.append(' class="is-blocking" ')
-    res.append('>')
+    res.append('><tbody>')
 
     res.append("<tr>")
 
@@ -137,7 +138,7 @@ def sort_key(t):
         res.append('<td class="position-empty"></td>')
         i = i + 1
 
-    res.append("</tr></table></a>")
+    res.append("</tr></tbody></table></a>")
     res.append('<div id="modal-%d" class="modal fade" tabindex="-1" role="dialog" aria-hidden="true"><div class="modal-dialog modal-dialog-scrollable modal-xl"><div class="modal-content"></div></div></div>' % ballot.pk)
 
     return mark_safe("".join(res))

ietf/doc/templatetags/ietf_filters.py

@@ -413,13 +413,13 @@ def format_snippet(text, trunc_words=25):
     full = keep_spacing(collapsebr(linebreaksbr(mark_safe(sanitize_fragment(text)))))
     snippet = truncatewords_html(full, trunc_words)
     if snippet != full:
-        return mark_safe('<div class="snippet">%s<button class="btn btn-sm btn-primary show-all"><i class="bi bi-caret-down"></i></button></div><div class="visually-hidden full">%s</div>' % (snippet, full))
+        return mark_safe('<div class="snippet">%s<button type="button" aria-label="Expand" class="btn btn-sm btn-primary show-all"><i class="bi bi-caret-down"></i></button></div><div class="visually-hidden full">%s</div>' % (snippet, full))
     return mark_safe(full)
 
 @register.simple_tag
 def doc_edit_button(url_name, *args, **kwargs):
     """Given URL name/args/kwargs, looks up the URL just like "url" tag and returns a properly formatted button for the document material tables."""
-    return mark_safe('<a class="btn btn-primary btn-sm" role="button" href="%s">Edit</a>' % (urlreverse(url_name, args=args, kwargs=kwargs)))
+    return mark_safe('<a class="btn btn-primary btn-sm" type="button" href="%s">Edit</a>' % (urlreverse(url_name, args=args, kwargs=kwargs)))
 
 @register.filter
 def textify(text):

ietf/doc/tests.py

@@ -1595,7 +1595,7 @@ def test_document_ballot_popup_unique_anchors_per_doc(self):
             href = q(f'div.balloter-name a[href$="{author_slug}"]').attr('href')
             ids = [
                 target.attr('id')
-                for target in q(f'h5[id$="{author_slug}"]').items()
+                for target in q(f'p.h5[id$="{author_slug}"]').items()
             ]
             self.assertEqual(len(ids), 1, 'Should be exactly one link for the balloter')
             self.assertEqual(href, f'#{ids[0]}', 'Anchor href should match ID')

ietf/doc/tests_ballot.py

@@ -1196,9 +1196,9 @@ def test_ballotpositiondocevent_any_email_sent(self):
         )
 
     def _assertBallotMessage(self, q, balloter, expected):
-        heading = q(f'h5[id$="_{slugify(balloter.plain_name())}"]')
+        heading = q(f'p.h5[id$="_{slugify(balloter.plain_name())}"]')
         self.assertEqual(len(heading), 1)
-        # <h5/> is followed by a panel with the message of interest, so use next()
+        # <p.h5/> is followed by a panel with the message of interest, so use next()
         self.assertEqual(
             len(heading.next().find(
                 f'*[title="{expected}"]'
@@ -1379,4 +1379,4 @@ def test_document_ballot_content_without_send_email_values(self):
         q = PyQuery(content)
         self._assertBallotMessage(q, balloters[0], 'No email send requests for this discuss')
         self._assertBallotMessage(q, balloters[1], 'No ballot position send log available')
-        self._assertBallotMessage(q, old_balloter, 'No ballot position send log available')
+        self._assertBallotMessage(q, old_balloter, 'No ballot position send log available')

ietf/doc/tests_draft.py

@@ -106,7 +106,7 @@ def test_change_state(self):
         self.assertEqual(len(q('form select[name=state]')), 1)
 
         if next_states:
-            self.assertEqual(len(q('[type=submit][value="%s"]' % next_states[0].name)), 1)
+            self.assertEqual(len(q('[type=submit]:contains("%s")' % next_states[0].name)), 1)
 
 
         # faulty post
@@ -148,7 +148,7 @@ def test_change_state(self):
         r = self.client.get(url)
         self.assertEqual(r.status_code, 200)
         q = PyQuery(r.content)
-        self.assertEqual(len(q('form [type=submit][value="%s"]' % first_state.name)), 1)
+        self.assertEqual(len(q('form [type=submit]:contains("%s")' % first_state.name)), 1)
 
     def test_pull_from_rfc_queue(self):
         ad = Person.objects.get(user__username="ad")
@@ -1383,7 +1383,7 @@ def verify_can_see(username):
             r = self.client.get(url)
             self.assertEqual(r.status_code,200)
             q = PyQuery(r.content)
-            self.assertEqual(len(q('form input[name="confirm"]')),1) 
+            self.assertEqual(len(q('form button[name="confirm"]')),1)
 
         url = urlreverse('ietf.doc.views_draft.to_iesg', kwargs=dict(name=self.docname))
 

ietf/doc/tests_review.py

@@ -38,6 +38,7 @@
 from ietf.utils.test_utils import login_testing_unauthorized, reload_db_objects
 from ietf.utils.test_utils import TestCase
 from ietf.utils.text import strip_prefix, xslugify
+from django.utils.html import escape
 
 class ReviewTests(TestCase):
     def setUp(self):
@@ -175,7 +176,7 @@ def test_review_request(self):
         self.assertContains(r, review_req.team.name)
         try:
             # FIXME-LARS
-            self.assertContains(r, author.name)
+            self.assertContains(r, escape(author.name))
         except:
             print(r.content)
             self.assertContains(r, author.name)

ietf/doc/views_ballot.py

@@ -574,7 +574,7 @@ def lastcalltext(request, name):
             e.save()
 
             # make sure form has the updated text
-            form = LastCallTextForm(initial=dict(last_call_text=e.text))
+            form = LastCallTextForm(initial=dict(last_call_text=escape(e.text)))
 
 
     s = doc.get_state("draft-iesg")
@@ -813,7 +813,7 @@ def ballot_approvaltext(request, name):
             e.save()
 
             # make sure form has the updated text
-            form = ApprovalTextForm(initial=dict(approval_text=e.text))
+            form = ApprovalTextForm(initial=dict(approval_text=escape(e.text)))
 
     can_announce = doc.get_state("draft-iesg").order > 19
     need_intended_status = ""

ietf/doc/views_charter.py

@@ -556,8 +556,8 @@ def review_announcement_text(request, name):
             (existing, existing_new_work) = default_review_text(group, charter, by)
             existing.save()
             existing_new_work.save()
-            form = ReviewAnnouncementTextForm(initial=dict(announcement_text=existing.text,
-                                                           new_work_text=existing_new_work.text))
+            form = ReviewAnnouncementTextForm(initial=dict(announcement_text=escape(existing.text),
+                                                           new_work_text=escape(existing_new_work.text)))
 
         if any(x in request.POST for x in ['send_annc_only','send_nw_only','send_both']) and form.is_valid():
             if any(x in request.POST for x in ['send_annc_only','send_both']):
@@ -613,7 +613,7 @@ def action_announcement_text(request, name):
         if "regenerate_text" in request.POST:
             e = default_action_text(group, charter, by)
             e.save()
-            form = ActionAnnouncementTextForm(initial=dict(announcement_text=e.text))
+            form = ActionAnnouncementTextForm(initial=dict(announcement_text=escape(e.text)))
 
         if "send_text" in request.POST and form.is_valid():
             parsed_msg = send_mail_preformatted(request, form.cleaned_data['announcement_text'])

ietf/doc/views_status_change.py

@@ -716,7 +716,7 @@ def last_call(request, name):
 
         if "regenerate_last_call_text" in request.POST:
             e = generate_last_call_text(request,status_change)
-            form = LastCallTextForm(initial=dict(last_call_text=e.text))
+            form = LastCallTextForm(initial=dict(last_call_text=escape(e.text)))
 
     return render(request, 'doc/status_change/last_call.html',
                                dict(doc=status_change,

ietf/group/tests_info.py

@@ -1527,7 +1527,7 @@ def test_can_switch_date_types_for_initial_charter(self):
         r = self.client.get(url)
         self.assertEqual(r.status_code, 200)
         q = PyQuery(r.content)
-        self.assertEqual(q('#switch-date-use-form button').attr('style'), 'display:none;')     
+        self.assertTrue(q('#switch-date-use-form button').hasClass('d-none'))
 
         ms.group.charter.rev='00-00'
         ms.group.charter.save()

ietf/ietfauth/views.py

@@ -744,17 +744,17 @@ def login(request, extra_context=None):
             logout(request)
             response = render(request, 'registration/missing_person.html')
         if require_consent:
-            messages.warning(request, mark_safe("""
+            messages.warning(request, mark_safe('''
 
                 You have personal information associated with your account which is not
                 derived from draft submissions or other ietf work, namely: %s.  Please go
-                to your <a href='/accounts/profile'>account profile</a> and review your
+                to your <a href="/accounts/profile">account profile</a> and review your
                 personal information, then scoll to the bottom and check the 'confirm'
                 checkbox and submit the form, in order to to indicate that that the
                 provided personal information may be used and displayed within the IETF
                 datatracker.
 
-                """ % ', '.join(require_consent)))
+                ''' % ', '.join(require_consent)))
     return response
 
 @login_required
@@ -816,4 +816,4 @@ def clean_key(self):
             messages.error(request, "Key validation failed; key not disabled")
     else:
         form = KeyDeleteForm(request.GET)
-    return render(request, 'form.html', {'form':form, 'title':"Disable a personal API key", 'description':'', 'button':'Disable key'})
+    return render(request, 'form.html', {'form':form, 'title':"Disable a personal API key", 'description':'', 'button':'Disable key'})

ietf/liaisons/tests.py

@@ -317,21 +317,21 @@ def test_taken_care_of(self):
         r = self.client.get(url)
         self.assertEqual(r.status_code, 200)
         q = PyQuery(r.content)
-        self.assertEqual(len(q('form input[name=do_action_taken]')), 0)
+        self.assertEqual(len(q('form button[name=do_action_taken]')), 0)
 
         # log in and get
         self.client.login(username="secretary", password="secretary+password")
 
         r = self.client.get(url)
         self.assertEqual(r.status_code, 200)
         q = PyQuery(r.content)
-        self.assertEqual(len(q('form input[name=do_action_taken]')), 1)
+        self.assertEqual(len(q('form button[name=do_action_taken]')), 1)
 
         # mark action taken
         r = self.client.post(url, dict(do_action_taken="1"))
         self.assertEqual(r.status_code, 200)
         q = PyQuery(r.content)
-        self.assertEqual(len(q('form input[name=do_action_taken]')), 0)
+        self.assertEqual(len(q('form button[name=do_action_taken]')), 0)
         liaison = LiaisonStatement.objects.get(id=liaison.id)
         self.assertTrue(liaison.action_taken)
 
@@ -357,7 +357,7 @@ def test_approval_process(self):
         self.assertEqual(r.status_code, 200)
         self.assertContains(r, liaison.title)
         q = PyQuery(r.content)
-        self.assertEqual(len(q('form input[name=approved]')), 0)
+        self.assertEqual(len(q('form button[name=approved]')), 0)
 
         # check the detail page / authorized
         self.client.login(username="ulm-liaiman", password="ulm-liaiman+password")
@@ -368,7 +368,7 @@ def test_approval_process(self):
         from ietf.liaisons.utils import can_edit_liaison
         user = User.objects.get(username='ulm-liaiman')
         self.assertTrue(can_edit_liaison(user, liaison))
-        self.assertEqual(len(q('form input[name=approved]')), 1)
+        self.assertEqual(len(q('form button[name=approved]')), 1)
 
         # approve
         mailbox_before = len(outbox)