models: user affiliations schema disallow html attrs

invenio_accounts/profiles/dicts.py

@@ -20,18 +20,19 @@ class ValidatedDict(dict):
     def __init__(self, schema, *args, **kwargs):
         """Constructor, validates the given data."""
         self._schema = schema() if isclass(schema) else schema
-        self._validate(dict(*args, **kwargs))
-        super().__init__(*args, **kwargs)
+        data = self._validate(dict(*args, **kwargs))
+        super().__init__(**data)
 
     def _validate(self, data):
-        """Validate the data with the dictionary's schema."""
+        """Validate the data with the dictionary's schema and return the valid value."""
         try:
             if self._schema is not None:
                 # without schema, we basically revert to a normal dictionary
                 # with more overhead
-                self._schema.load(data)
+                return self._schema.load(data)
         except ValidationError as error:
             raise ValueError(f"Validation failed: {error}")
+        return data
 
     def _try_op(self, op_name, *args, **kwargs):
         """Try the named operation and see if it violates the schema."""
@@ -67,8 +68,9 @@ def setdefault(self, key, default=None):
     def __setitem__(self, key, value):
         """Validate the dictionary and set the value if successful."""
         data = {**self, key: value}
-        self._validate(data)
-        super().__setitem__(key, value)
+        data = self._validate(data)
+        # set schema loaded value
+        super().__setitem__(key, data[key])
 
     def __delitem__(self, key):
         """Validate the dictionary and delete the key if successful."""

invenio_accounts/profiles/schemas.py

@@ -12,7 +12,8 @@
 from flask import current_app
 from invenio_i18n import lazy_gettext as _
 from marshmallow import Schema, ValidationError, fields
-
+from marshmallow_utils.fields import SanitizedHTML
+from marshmallow_utils.html import strip_html
 
 def validate_visibility(value):
     """Check if the value is a valid visibility setting."""
@@ -43,7 +44,8 @@ class UserProfileSchema(Schema):
     """The default user profile schema."""
 
     full_name = fields.String()
-    affiliations = fields.String()
+    # disallow all HTML tags and attrs on deserialization
+    affiliations = SanitizedHTML(tags=[], attrs=[])
 
 
 class UserPreferencesSchema(Schema):