Mercurial > p > roundup > code
diff test/test_cgi.py @ 4851:24b8011cd2dc
Fix XSS in issue2550817
Note that the code that triggers that particular bug is no longer in
roundup core. But the change to the templates we suggest is a *lot*
safer as it always escapes the error and ok messages now.
If you are upgrading: you *MUST* read doc/upgrading.txt and do the
necessary changes to your templates, the escaping now happens in the
template and not in the roundup code. So if you don't make the necessary
changes *you are vulnerable*.
| author | Ralf Schlatterbeck <rsc@runtux.com> |
|---|---|
| date | Fri, 20 Dec 2013 18:24:10 +0100 |
| parents | dad18ee491a9 |
| children | ca692423e401 |
line wrap: on
line diff
--- a/test/test_cgi.py Wed Dec 18 09:02:40 2013 +0100 +++ b/test/test_cgi.py Fri Dec 20 18:24:10 2013 +0100 @@ -43,29 +43,13 @@ cm = client.clean_message class MessageTestCase(unittest.TestCase): # Note: We used to allow some html tags in error message. Now *only* - # newlines are allowed which are translated to <br />. - # All other tags are escaped. + # newlines are allowed and messages are split at newlines. + # Note that tags are no longer escaped, see doc/upgrading.txt for + # the changes needed in the templates (Migrating from 1.5.0 to 1.5.1) def testCleanMessageOK(self): - self.assertEqual(cm('a\nb'), 'a<br />\nb') - self.assertEqual(cm('a\nb\nc\n'), 'a<br />\nb<br />\nc<br />\n') - - def testCleanMessageBAD(self): - self.assertEqual(cm('<script>x</script>'), - '<script>x</script>') - self.assertEqual(cm('<iframe>x</iframe>'), - '<iframe>x</iframe>') - self.assertEqual(cm('<<script >>alert(42);5<</script >>'), - '<<script >>alert(42);5<</script >>') - self.assertEqual(cm('<a href="y">x</a>'), - '<a href="y">x</a>') - self.assertEqual(cm('<A HREF="y">x</A>'), - '<A HREF="y">x</A>') - self.assertEqual(cm('<br>x<br />'), '<br>x<br />') - self.assertEqual(cm('<i>x</i>'), '<i>x</i>') - self.assertEqual(cm('<b>x</b>'), '<b>x</b>') - self.assertEqual(cm('<BR>x<BR />'), '<BR>x<BR />') - self.assertEqual(cm('<I>x</I>'), '<I>x</I>') - self.assertEqual(cm('<B>x</B>'), '<B>x</B>') + self.assertEqual(cm('a'), ['a']) + self.assertEqual(cm('a\nb'), ['a','b']) + self.assertEqual(cm('a\nb\nc\n'), ['a','b','c','']) class FormTestCase(unittest.TestCase): def setUp(self):
