From c40f5a22ec658528c966f6245f74bf005a212e12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20P=C3=A9ters?= <fpeters@entrouvert.com>
Date: Fri, 7 Apr 2023 08:07:16 +0200
Subject: [PATCH] misc: strip emojis from buttons (#76405)

---
 debian/control        |  1 +
 setup.py              |  1 +
 tests/test_widgets.py | 24 ++++++++++++++++++++++++
 wcs/qommon/form.py    | 11 ++++++++---
 4 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/debian/control b/debian/control
index aa420b496..534de8164 100644
--- a/debian/control
+++ b/debian/control
@@ -22,6 +22,7 @@ Depends: graphviz,
          python3-django-ckeditor,
          python3-django-ratelimit,
          python3-dnspython,
+         python3-emoji,
          python3-hobo,
          python3-lasso,
          python3-lxml,
diff --git a/setup.py b/setup.py
index 32f9f0ba3..b8a72a03d 100644
--- a/setup.py
+++ b/setup.py
@@ -203,6 +203,7 @@ setup(
         'requests',
         'setproctitle',
         'phonenumbers',
+        'emoji',
     ],
     package_dir={'wcs': 'wcs'},
     packages=find_packages(),
diff --git a/tests/test_widgets.py b/tests/test_widgets.py
index f779ae272..77d20fd1c 100644
--- a/tests/test_widgets.py
+++ b/tests/test_widgets.py
@@ -4,6 +4,7 @@ import shutil
 
 import mechanize
 import pytest
+from pyquery import PyQuery
 from quixote import cleanup, get_response
 from quixote.http_request import parse_query
 
@@ -1409,3 +1410,26 @@ def test_condition_widget_no_python():
     assert widget.get_error() == "syntax error: Could not parse the remainder: '{{' from '{{'"
 
     pub.site_options.set('options', 'disable-python-expressions', 'false')
+
+
+def test_emoji_button():
+    # textual button
+    form = Form(use_tokens=False)
+    form.add_submit('submit', 'Submit')
+    assert PyQuery(str(form.render()))('button').attr.name == 'submit'
+    assert not PyQuery(str(form.render()))('button').attr['aria-label']
+    assert PyQuery(str(form.render()))('button').text() == 'Submit'
+
+    # emoji + text
+    form = Form(use_tokens=False)
+    form.add_submit('submit', '✅ Submit')
+    assert PyQuery(str(form.render()))('button').attr.name == 'submit'
+    assert PyQuery(str(form.render()))('button').attr['aria-label'] == 'Submit'
+    assert PyQuery(str(form.render()))('button').text() == '✅ Submit'
+
+    # single emoji (do not do this) (no empty aria-label)
+    form = Form(use_tokens=False)
+    form.add_submit('submit', '✅')
+    assert PyQuery(str(form.render()))('button').attr.name == 'submit'
+    assert not PyQuery(str(form.render()))('button').attr['aria-label']
+    assert PyQuery(str(form.render()))('button').text() == '✅'
diff --git a/wcs/qommon/form.py b/wcs/qommon/form.py
index 86f9185ac..ed098aa6b 100644
--- a/wcs/qommon/form.py
+++ b/wcs/qommon/form.py
@@ -37,6 +37,7 @@ from functools import partial
 import dns
 import dns.exception
 import dns.resolver
+import emoji
 from bleach import Cleaner
 from bleach.linkifier import LinkifyFilter
 from PIL import Image
@@ -208,10 +209,14 @@ class SubmitWidget(quixote.form.widget.SubmitWidget):
     def render_content(self):
         if self.name in ('cancel', 'previous', 'save-draft'):
             self.attrs['formnovalidate'] = 'formnovalidate'
-        value = htmlescape(self.label) if self.label else None
+        label = self.label or ''
+        if label and 'aria-label' not in self.attrs:
+            cleaned_label = emoji.replace_emoji(label, replace='').strip()
+            if cleaned_label and cleaned_label != label:
+                self.attrs['aria-label'] = cleaned_label
         return (
-            htmltag('button', name=self.name, value=value, **self.attrs)
-            + str(self.label)
+            htmltag('button', name=self.name, value=htmlescape(label), **self.attrs)
+            + str(label)
             + htmltext('</button>')
         )