view test/test_memorydb.py @ 5161:12190efa30d4

I realized that the __came_from and __redirect_to url parameters I added to handle issues with the LoginAction and NewItemAction could be used for XSS or other purposes. So I check them using a new clean_url(url) function. This tries to validate that the url is under the tracker's base url and that the components of the url are properly url encoded. If it thinks something is wrong with the url, it will raise a ValueError. I decided to not attempt to fix the url's if there is an issue, better to bring it to the tracker admin's attention. Changed the code paths in NewItemAction and LoginAction that deal with the form parameters to use the clean_url function on the form input first.
author John Rouillard <rouilj@ieee.org>
date Sat, 23 Jul 2016 14:00:49 -0400
parents 364c54991861
children 62de601bdf6f
line wrap: on
line source

import unittest, os, shutil, time

from roundup import hyperdb

from db_test_base import DBTest, ROTest, SchemaTest, config, setupSchema
import memorydb

class memorydbOpener:
    module = memorydb

    def nuke_database(self):
        # really kill it
        self.db = None

    db = None
    def open_database(self):
        if self.db is None:
            self.db = self.module.Database(config, 'admin')
        return self.db

    def setUp(self):
        self.open_database()
        setupSchema(self.db, 1, self.module)

    def tearDown(self):
        if self.db is not None:
            self.db.close()

    # nuke and re-create db for restore
    def nukeAndCreate(self):
        self.db.close()
        self.nuke_database()
        self.db = self.module.Database(config, 'admin')
        setupSchema(self.db, 0, self.module)


class memorydbDBTest(memorydbOpener, DBTest, unittest.TestCase):
    pass


class memorydbROTest(memorydbOpener, ROTest, unittest.TestCase):
    def setUp(self):
        self.db = self.module.Database(config)
        setupSchema(self.db, 0, self.module)


class memorydbSchemaTest(memorydbOpener, SchemaTest, unittest.TestCase):
    pass


from session_common import DBMTest
class memorydbSessionTest(memorydbOpener, DBMTest, unittest.TestCase):
    def setUp(self):
        self.db = self.module.Database(config, 'admin')
        setupSchema(self.db, 1, self.module)
        self.sessions = self.db.sessions

# vim: set filetype=python ts=4 sw=4 et si


Roundup Issue Tracker: http://roundup-tracker.org/