Njdupoux/proxy bug fix

Fix for proxy bugs stemming from improper html sanitization

In order to prevent improper html being sent back from the grader and proxy due to lack of escaping of characters such as "&", I've cleaned up the html formatting code to cleanly sanitize the html feedback response received from the grader. This includes proper html escaping. 

I've also written a few units tests to test the sanitization, and added some documentation 
That's great that you tested this.  Care to put it in a test?


On Wed, Jul 2, 2014 at 9:30 PM, Nicholas Dupoux <notifications@github.com>
wrote:

> In proxy_server/views.py:
>
> >
> >      return HttpResponse('{"correct": ' + isCorrect + ', "score": ' + score + ', "msg": "' + feedback + '"}')
> >
> > +def truncateFeedback(feedback):
> > +    """
> > +    Trims feedback to an acceptable length for displaying
> > +    """
> > +    tmp = "<p>Message Too Long. Here is a snapshot:"
> > +
> > +    feedback = feedback[0:FEEDBACK_TRIM_LENGTH]
> > +    lastIndex = feedback.rfind(">")
> > +    feedback = feedback[0:lastIndex + 1]
> > +
> > +    # Now sanitize the newly trimmed html
> > +    feedback = sanitizeFeedback(feedback)
> > +    feedback = tmp + feedback + "</p>"
>
> That's a great point and I was worried about losing that functionality.
> But the call to sanitizeFeedback in here in turn calls bleach.clean, which
> should handle pairing off any mismatched tags that were left due to the
> truncation. I tested out generating some huge outputs that followed this
> code path, and they seemed to be properly formatted when they came out the
> other end.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/Stanford-Online/db-grader-proxy/pull/2/files#r14496582>
> .
>