fix: ticket xss inject

apps/settings/serializers/email.py

@@ -10,8 +10,8 @@ __all__ = ['MailTestSerializer', 'EmailSettingSerializer', 'EmailContentSettingS
 
 
 class MailTestSerializer(serializers.Serializer):
-    EMAIL_FROM = serializers.CharField(required=False, allow_blank=True)
-    EMAIL_RECIPIENT = serializers.CharField(required=False, allow_blank=True)
+    EMAIL_FROM = serializers.CharField(required=False, allow_null=True, allow_blank=True)
+    EMAIL_RECIPIENT = serializers.CharField(required=False, allow_null=True, allow_blank=True)
 
 
 class EmailSettingSerializer(serializers.Serializer):

apps/terminal/utils/db_port_mapper.py

@@ -51,22 +51,23 @@ class DBPortManager(object):
 
     def pop(self, db: Application):
         mapper = self.get_mapper()
-        to_delete_port = self.get_port_by_db(db)
+        to_delete_port = self.get_port_by_db(db, raise_exception=False)
         mapper.pop(to_delete_port, None)
         self.set_mapper(mapper)
 
-    def get_port_by_db(self, db):
+    def get_port_by_db(self, db, raise_exception=True):
         mapper = self.get_mapper()
         for port, db_id in mapper.items():
             if db_id == str(db.id):
                 return port
-        error = _(
-            'No available port is matched. '
-            'The number of databases may have exceeded the number of ports '
-            'open to the database agent service, '
-            'Contact the administrator to open more ports.'
-        )
-        raise JMSException(error)
+        if raise_exception:
+            error = _(
+                'No available port is matched. '
+                'The number of databases may have exceeded the number of ports '
+                'open to the database agent service, '
+                'Contact the administrator to open more ports.'
+            )
+            raise JMSException(error)
 
     def get_db_by_port(self, port):
         try:

apps/tickets/handlers/base.py

@@ -1,3 +1,5 @@
+from html import escape
+
 from django.utils.translation import ugettext as _
 from django.template.loader import render_to_string
 
@@ -96,11 +98,19 @@ class BaseHandler:
         approve_info = _('{} {} the ticket').format(user_display, state_display)
         context = self._diff_prev_approve_context(state)
         context.update({'approve_info': approve_info})
+        body = self.reject_html_script(
+            render_to_string('tickets/ticket_approve_diff.html', context)
+        )
         data = {
-            'body': render_to_string('tickets/ticket_approve_diff.html', context),
+            'body': body,
             'user': user,
             'user_display': str(user),
             'type': 'state',
             'state': state
         }
         return self.ticket.comments.create(**data)
+
+    @staticmethod
+    def reject_html_script(unsafe_html):
+        safe_html = escape(unsafe_html)
+        return safe_html