Mercurial > p > roundup > code
annotate test/cmp_helper.py @ 8062:28aa76443f58
fix(security): fix CVE-2024-39124, CVE-2024-39124, and CVE-2024-39125
Directions for fixing:
* `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are
vulnerable to an XSS attack. <CVE-2024-39124>` Requires fixing
tracker homes.
* `CVE-2024-39125`_ - :ref:`if Referer header is set to a script
tag, it will be executed. <CVE-2024-39125>` Fixed in release 2.4.0,
directions available for fixing in prior versions.
* `CVE-2024-39126`_ - :ref:`PDF, XML and SVG files downloaded from
an issue can contain embedded JavaScript which is
executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions
available for fixing in prior versions.
prior to 2.4.0 release this weekend that fixes the last two CVE's.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 09 Jul 2024 09:07:09 -0400 |
| parents | 19bd4b413ed6 |
| children |
| rev | line source |
|---|---|
|
5513
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
1 class StringFragmentCmpHelper: |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
2 def compareStringFragments(self, s, fragments): |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
3 """Compare a string agains a list of fragments where a tuple denotes a |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
4 set of alternatives |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
5 """ |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
6 pos = 0 |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
7 for frag in fragments: |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
8 if type(frag) != tuple: |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
9 self.assertEqual(s[pos:pos + len(frag)], frag) |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
10 pos += len(frag) |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
11 else: |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
12 found = False |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
13 for alt in frag: |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
14 if s[pos:pos + len(alt)] == alt: |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
15 pos += len(alt) |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
16 found = True |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
17 break |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
18 |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
19 if not found: |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
20 l = max(map(len, frag)) |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
21 raise AssertionError('%s != %s' % |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
22 (repr(s[pos:pos + l]), str(frag))) |
|
19bd4b413ed6
be more lenient when comparing string results
Christof Meerwald <cmeerw@cmeerw.org>
parents:
diff
changeset
|
23 self.assertEqual(s[pos:], '') |
