From 2820ef9e2124a9fa519852b623cfa6a23a534858 Mon Sep 17 00:00:00 2001
From: n9k <originalcocaineninja@protonmail.com>
Date: Sun, 24 Jul 2022 10:20:00 +0000
Subject: [PATCH] Emotes: allow automatic width/height

---
 anonstream/helpers/chat.py | 6 ++++--
 anonstream/utils/chat.py   | 7 +++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/anonstream/helpers/chat.py b/anonstream/helpers/chat.py
index 81a517f..725d2b4 100644
--- a/anonstream/helpers/chat.py
+++ b/anonstream/helpers/chat.py
@@ -23,10 +23,12 @@ def get_scrollback(messages):
 @lru_cache
 def get_emote_markup(emote_name, emote_file, emote_width, emote_height):
     emote_name_markup = escape(emote_name)
+    width = '' if emote_width is None else f'width="{escape(emote_width)}" '
+    height = '' if emote_height is None else f'height="{escape(emote_height)}" '
     return Markup(
         f'''<img class="emote" '''
-        f'''src="{url_for('static', filename=emote_file)}" '''
-        f'''width="{escape(emote_width)}" height="{escape(emote_height)}" '''
+        f'''src="{escape(url_for('static', filename=emote_file))}" ''' # XXX cherry-pick security fix
+        f'''{width}{height}'''
         f'''alt="{emote_name_markup}" title="{emote_name_markup}">'''
     )
 
diff --git a/anonstream/utils/chat.py b/anonstream/utils/chat.py
index 86d49ab..916a49c 100644
--- a/anonstream/utils/chat.py
+++ b/anonstream/utils/chat.py
@@ -35,10 +35,13 @@ def precompute_emote_regex(schema):
     for emote in schema:
         assert emote['name'], 'emote names cannot be empty'
         assert not re.search(r'\s', emote['name']), \
-            'whitespace is not allowed in emote names'
+            f'whitespace is not allowed in emote names: {emote["name"]!r}'
+        for length in (emote['width'], emote['height']):
+            assert length is None or isinstance(length, int) and length >= 0, \
+                f'emote dimensions must be null or non-negative integers: {emote["name"]!r}'
         # If the emote name begins with a word character [a-zA-Z0-9_],
         # match only if preceded by a non-word character or the empty
-        # string. Similarly for the end of the emote name.
+        # string.  Similarly for the end of the emote name.
         # Examples:
         #  * ":joy:" matches "abc :joy:~xyz"   and   "abc:joy:xyz"
         #  * "JoySi" matches "abc JoySi~xyz" but NOT "abcJoySiabc"