annotate test/test_mailer.py @ 4880:ca692423e401

Different approach to fix XSS in issue2550817 Encapsulate the error/ok message append method as add_ok_message and add_error_message. The new approach escapes the messages when appending -- at a point in the code where we still know where the message comes from. Escaping is the default but can bei turned off. This also fixes issue2550836 where certain messages may contain links. Another advantage of the new fix is that users don't need to change installed trackers and are secure by default.
author Ralf Schlatterbeck <rsc@runtux.com>
date Mon, 31 Mar 2014 18:19:23 +0200
parents 182d8c41a3aa
children 364c54991861
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
4338
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
1 #-*- encoding: utf8 -*-
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
2 import unittest
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
3
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
4 from roundup import mailer
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
5
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
6 class EncodingTestCase(unittest.TestCase):
4520
182d8c41a3aa Fix mailer encoding test:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents: 4338
diff changeset
7 def testEncoding(self):
4338
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
8 a = lambda n, a, c, o: self.assertEquals(mailer.nice_sender_header(n,
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
9 a, c), o)
4520
182d8c41a3aa Fix mailer encoding test:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents: 4338
diff changeset
10 a('ascii', 'ascii@test.com', 'iso8859-1', 'ascii <ascii@test.com>')
182d8c41a3aa Fix mailer encoding test:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents: 4338
diff changeset
11 a(u'café', 'ascii@test.com', 'iso8859-1',
182d8c41a3aa Fix mailer encoding test:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents: 4338
diff changeset
12 '=?iso8859-1?q?caf=E9?= <ascii@test.com>')
182d8c41a3aa Fix mailer encoding test:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents: 4338
diff changeset
13 a('as"ii', 'ascii@test.com', 'iso8859-1', '"as\\"ii" <ascii@test.com>')
4338
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
14
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
15 def test_suite():
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
16 suite = unittest.TestSuite()
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
17 suite.addTest(unittest.makeSuite(EncodingTestCase))
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
18 return suite
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
19
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
20 if __name__ == '__main__':
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
21 runner = unittest.TextTestRunner()
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
22 unittest.main(testRunner=runner)
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
23
94ee533613ac Attempt to generate more human-readable addresses in email
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
24 # vim: set et sts=4 sw=4 :

Roundup Issue Tracker: http://roundup-tracker.org/