Issue 3402 - Properly handle nested inline tags

cms/converters.py

 # coding: utf-8
 
 # This file is part of the Adblock Plus web scripts,
 # Copyright (C) 2006-2016 Eyeo GmbH
 #
 # Adblock Plus is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 3 as
 # published by the Free Software Foundation.
 #
 # Adblock Plus is distributed in the hope that it will be useful,
@@ skipping 163 matching lines @@
 
     # Insert attributes
     result = escape(result)
     def stringify_attribute((name, value)):
       return '%s="%s"' % (
         escape(name),
         escape(self.insert_localized_strings(value, {}))
       )
 
     for tag in self.whitelist:
+      allowed_contents = "(?:[^<>]|%s)" % "|".join((
+        "<(?:%s[^<>]*?|/%s)>" % (t, t)
+         for t in map(re.escape, self.whitelist - {tag})
+      ))
       saved = saved_attributes.get(tag, [])
       for attrs in saved:
         attrs = map(stringify_attribute, attrs)
         result = re.sub(
-          r"%s([^<>]*?)%s" % (re_escape("<%s>" % tag), re_escape("</%s>" % tag)),
+          r"%s(%s*?)%s" % (re_escape("<%s>" % tag), allowed_contents,
+                           re_escape("</%s>" % tag)),
           lambda match: r'<%s%s>%s</%s>' % (
             tag,
             " " + " ".join(attrs) if attrs else "",
             match.group(1),
             tag
           ),
           result, 1, flags=re.S
         )
       result = re.sub(
-        r"%s([^<>]*?)%s" % (re_escape("<%s>" % tag), re_escape("</%s>" % tag)),
+        r"%s(%s*?)%s" % (re_escape("<%s>" % tag), allowed_contents,
+                         re_escape("</%s>" % tag)),
         r"<%s>\1</%s>" % (tag, tag),
         result, flags=re.S
       )
     return result
 
   def insert_localized_strings(self, text, escapes, to_html=lambda s: s):
     def lookup_string(match):
       name, comment, default = match.groups()
       if default:
         default = to_html(default).strip()
@@ skipping 228 matching lines @@
         stack.pop()
       stack[-1]["subitems"].append(item)
       stack.append(item)
     return structured
 
 converters = {
   "html": RawConverter,
   "md": MarkdownConverter,
   "tmpl": TemplateConverter,
 }