Mercurial > p > roundup > code
diff test/test_cgi.py @ 1685:b6621f8bd496 maint-0.5
backported XSS message cleaning fix [SF#757128]
| author | Richard Jones <richard@users.sourceforge.net> |
|---|---|
| date | Tue, 24 Jun 2003 03:33:56 +0000 |
| parents | a61ca144d3a4 |
| children |
line wrap: on
line diff
--- a/test/test_cgi.py Tue Jun 24 03:09:35 2003 +0000 +++ b/test/test_cgi.py Tue Jun 24 03:33:56 2003 +0000 @@ -8,7 +8,7 @@ # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # -# $Id: test_cgi.py,v 1.4.2.2 2003-03-21 21:43:04 richard Exp $ +# $Id: test_cgi.py,v 1.4.2.3 2003-06-24 03:33:56 richard Exp $ import unittest, os, shutil, errno, sys, difflib, cgi @@ -24,6 +24,26 @@ form.list.append(cgi.MiniFieldStorage(k, v)) return form +cm = client.clean_message +class MessageTestCase(unittest.TestCase): + def testCleanMessageOK(self): + self.assertEqual(cm('<br>x<br />'), '<br>x<br />') + self.assertEqual(cm('<i>x</i>'), '<i>x</i>') + self.assertEqual(cm('<b>x</b>'), '<b>x</b>') + self.assertEqual(cm('<a href="y">x</a>'), + '<a href="y">x</a>') + self.assertEqual(cm('<BR>x<BR />'), '<BR>x<BR />') + self.assertEqual(cm('<I>x</I>'), '<I>x</I>') + self.assertEqual(cm('<B>x</B>'), '<B>x</B>') + self.assertEqual(cm('<A HREF="y">x</A>'), + '<A HREF="y">x</A>') + + def testCleanMessageBAD(self): + self.assertEqual(cm('<script>x</script>'), + '<script>x</script>') + self.assertEqual(cm('<iframe>x</iframe>'), + '<iframe>x</iframe>') + class FormTestCase(unittest.TestCase): def setUp(self): self.dirname = '_test_cgi_form' @@ -277,7 +297,9 @@ def suite(): - l = [unittest.makeSuite(FormTestCase), + l = [ + unittest.makeSuite(FormTestCase), + unittest.makeSuite(MessageTestCase), ] return unittest.TestSuite(l)
