diff test/test_cgi.py @ 4851:24b8011cd2dc

Fix XSS in issue2550817 Note that the code that triggers that particular bug is no longer in roundup core. But the change to the templates we suggest is a *lot* safer as it always escapes the error and ok messages now. If you are upgrading: you *MUST* read doc/upgrading.txt and do the necessary changes to your templates, the escaping now happens in the template and not in the roundup code. So if you don't make the necessary changes *you are vulnerable*.
author Ralf Schlatterbeck <rsc@runtux.com>
date Fri, 20 Dec 2013 18:24:10 +0100
parents dad18ee491a9
children ca692423e401
line wrap: on
line diff
--- a/test/test_cgi.py	Wed Dec 18 09:02:40 2013 +0100
+++ b/test/test_cgi.py	Fri Dec 20 18:24:10 2013 +0100
@@ -43,29 +43,13 @@
 cm = client.clean_message
 class MessageTestCase(unittest.TestCase):
     # Note: We used to allow some html tags in error message. Now *only*
-    # newlines are allowed which are translated to <br />.
-    # All other tags are escaped.
+    # newlines are allowed and messages are split at newlines.
+    # Note that tags are no longer escaped, see doc/upgrading.txt for
+    # the changes needed in the templates (Migrating from 1.5.0 to 1.5.1)
     def testCleanMessageOK(self):
-        self.assertEqual(cm('a\nb'), 'a<br />\nb')
-        self.assertEqual(cm('a\nb\nc\n'), 'a<br />\nb<br />\nc<br />\n')
-
-    def testCleanMessageBAD(self):
-        self.assertEqual(cm('<script>x</script>'),
-            '&lt;script&gt;x&lt;/script&gt;')
-        self.assertEqual(cm('<iframe>x</iframe>'),
-            '&lt;iframe&gt;x&lt;/iframe&gt;')
-        self.assertEqual(cm('<<script >>alert(42);5<</script >>'),
-            '&lt;&lt;script &gt;&gt;alert(42);5&lt;&lt;/script &gt;&gt;')
-        self.assertEqual(cm('<a href="y">x</a>'),
-            '&lt;a href="y"&gt;x&lt;/a&gt;')
-        self.assertEqual(cm('<A HREF="y">x</A>'),
-            '&lt;A HREF="y"&gt;x&lt;/A&gt;')
-        self.assertEqual(cm('<br>x<br />'), '&lt;br&gt;x&lt;br /&gt;')
-        self.assertEqual(cm('<i>x</i>'), '&lt;i&gt;x&lt;/i&gt;')
-        self.assertEqual(cm('<b>x</b>'), '&lt;b&gt;x&lt;/b&gt;')
-        self.assertEqual(cm('<BR>x<BR />'), '&lt;BR&gt;x&lt;BR /&gt;')
-        self.assertEqual(cm('<I>x</I>'), '&lt;I&gt;x&lt;/I&gt;')
-        self.assertEqual(cm('<B>x</B>'), '&lt;B&gt;x&lt;/B&gt;')
+        self.assertEqual(cm('a'), ['a'])
+        self.assertEqual(cm('a\nb'), ['a','b'])
+        self.assertEqual(cm('a\nb\nc\n'), ['a','b','c',''])
 
 class FormTestCase(unittest.TestCase):
     def setUp(self):

Roundup Issue Tracker: http://roundup-tracker.org/