[ENG-12505] Security: disable include functionality for .rst extension

mfr/extensions/rst/render.py

@@ -21,7 +21,7 @@ def __init__(self, *args, **kwargs):
 
     def _render(self):
         with open(self.file_path) as fp:
-            body = publish_parts(fp.read(), writer_name='html')['html_body']
+            body = publish_parts(fp.read(), writer_name='html', settings_overrides={'file_insertion_enabled': False, 'raw_enabled': False})['html_body']
             return self.TEMPLATE.render(base=self.assets_url, body=body)
 
     @property

tests/extensions/rst/files/include.rst

@@ -0,0 +1,8 @@
+=====================================================================
+Testing fetching file content inside directory with include directive
+=====================================================================
+
+Content of the setup.cfg file:
+
+.. include:: setup.cfg
+   :literal:

tests/extensions/rst/test_renderer.py

@@ -21,6 +21,11 @@ def invalid_file_path():
     return os.path.join(os.path.dirname(os.path.abspath(__file__)), 'files', 'invalid.rst')
 
 
+@pytest.fixture
+def include_file_path():
+    return os.path.join(os.path.dirname(os.path.abspath(__file__)), 'files', 'include.rst')
+
+
 @pytest.fixture
 def url():
     return 'http://osf.io/file/test.rst'
@@ -41,6 +46,11 @@ def renderer(metadata, test_file_path, url, assets_url, export_url):
     return RstRenderer(metadata, test_file_path, url, assets_url, export_url)
 
 
+@pytest.fixture
+def renderer_include(metadata, include_file_path, url, assets_url, export_url):
+    return RstRenderer(metadata, include_file_path, url, assets_url, export_url)
+
+
 class TestRstRenderer:
 
     def test_render_rst(self, renderer):
@@ -62,3 +72,9 @@ def test_render_rst_file_required(self, renderer):
 
     def test_render_rst_cache_result(self, renderer):
         assert renderer.cache_result is True
+
+    def test_render_rst_disable_include(self, renderer_include, include_file_path):
+        with open(include_file_path) as fp:
+            body = renderer_include._render()
+            assert '.. include:: setup.cfg' in body
+            assert '# E501: Line too long' not in body