Fixing cgi.escape DeprecationWarning

[leomartinez2020]

This pull request fixes the DeprecationWarning as stated in:
https://build.testeng.edx.org/job/edx-platform-python-pipeline-master/warning_5freport_5fall_2ehtml/

cgi.escape is deprecated in Python3:
https://docs.python.org/3.5/library/cgi.html#cgi.escape

Use html.escape instead:
https://docs.python.org/3.5/library/html.html#html.escape

@felipemontoya
@morenol
@Squirrel18
FYI: @jmbowman

[openedx-webhooks]

Thanks for the pull request, @leomartinez2019! I've created OSPR-4490 to keep track of it in JIRA. JIRA is a place for product owners to prioritize feature reviews by the engineering development teams.

Feel free to add as much of the following information to the ticket:

• supporting documentation
• edx-code email threads
• timeline information ("this must be merged by XX date", and why that is)
• partner information ("this is a course on edx.org")
• any other information that can help Product understand the context for the PR

All technical communication about the code itself will still be done via the GitHub pull request interface. As a reminder, our process documentation is here.

[morenol]

Hi @natabene, could you trigger the tests?

[natabene]

jenkins run all

[openedx-webhooks]

@leomartinez2019 Even though your pull request wasn’t merged, please take a moment to answer a two question survey so we can improve your experience in the future.

[natabene]

jenkins run all

[nedbat]

jenkins run quality

[natabene]

@leomartinez2019 Please address the failing quality test.

[leomartinez2020]

@leomartinez2019 Please address the failing quality test.

Jenkins reports these quality warnings:
common/lib/xmodule/xmodule/poll_module.py: 218:21: python-wrap-html: b" poll_str = u'<{tag_name}>{text}</{tag_name}>'.format("

common/lib/xmodule/xmodule/poll_module.py: 226:26: python-wrap-html: b' child_str = u\'<{tag_name} id="{id}">{text}</{tag_name}>\'.format('

Here the solution is suggested:
https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/preventing_xss/preventing_xss.html#python-wrap-html

Which consists of using the function HTML() from: openedx.core.djangolib.markup
I can update this branch to address these two warnings

With the suggested changes this test passes:
./scripts/xsslint/xss_linter.py common/lib/xmodule/xmodule/poll_module.py

0 violations total

[nedbat]

jenkins run all

[leomartinez2020]

Unfortunately when this test passes:
./scripts/xsslint/xss_linter.py common/lib/xmodule/xmodule/poll_module.py

This other fails:
pytest common/lib/xmodule/xmodule/tests/test_poll.py
With the message: AssertionError: '&lt; 18' != '< 18'

And viceversa, so I am still researching to find a solution

[morenol]

@leomartinez2019

I would say that < is the escaped version of <. So, I think that the way to solve this is just to change the assertion in the test

[nedbat]

It's not that simple. The assertion is a real failure.

AssertionError: '&lt; 18' != '< 18'

In this case, the XML actually contains < 18, so that the interpreted text is <

[natabene]

jenkins run all

[morenol]

Hi @natabene, could you trigger them again?

[awais786]

jenkins run all

[awais786]

jenkins run py38 python

[natabene]

jenkins run all

[awais786]

jenkins run py38 python

[jmbowman]

jenkins run py38 python

[jmbowman]

jenkins run all
jenkins run py38 python

[jmbowman]

jenkins run py38 python

[edx-status-bot]

Your PR has finished running tests. The following contexts failed:

• jenkins/python-3.8/python

[openedx-webhooks]

@leomartinez2019 🎉 Your pull request was merged!

Please take a moment to answer a two question survey so we can improve your experience in the future.

[edx-pipeline-bot]

EdX Release Notice: This PR has been deployed to the staging environment in preparation for a release to production.

[edx-pipeline-bot]

EdX Release Notice: This PR has been deployed to the production environment.