view test/test_rfc2822.py @ 4851:24b8011cd2dc

Fix XSS in issue2550817 Note that the code that triggers that particular bug is no longer in roundup core. But the change to the templates we suggest is a *lot* safer as it always escapes the error and ok messages now. If you are upgrading: you *MUST* read doc/upgrading.txt and do the necessary changes to your templates, the escaping now happens in the template and not in the roundup code. So if you don't make the necessary changes *you are vulnerable*.
author Ralf Schlatterbeck <rsc@runtux.com>
date Fri, 20 Dec 2013 18:24:10 +0100
parents 97f9fc0bc0ea
children
line wrap: on
line source

from roundup.rfc2822 import decode_header, encode_header

import unittest, time
 
class RFC2822TestCase(unittest.TestCase):
    def testDecode(self):
        src = 'Re: [it_issue3] '\
            '=?ISO-8859-1?Q?Ren=E9s_[resp=3Dg=2Cstatus=3D?= '\
            '=?ISO-8859-1?Q?feedback]?='
        result = 'Re: [it_issue3] Ren\xc3\xa9s [resp=g,status=feedback]'
        self.assertEqual(decode_header(src), result)

        src = 'Re: [it_issue3]'\
            ' =?ISO-8859-1?Q?Ren=E9s_[resp=3Dg=2Cstatus=3D?=' \
            ' =?ISO-8859-1?Q?feedback]?='
        result = 'Re: [it_issue3] Ren\xc3\xa9s [resp=g,status=feedback]'
        self.assertEqual(decode_header(src), result)

    def testEncode(self):
        src = 'Re: [it_issue3] Ren\xc3\xa9s [status=feedback]'
        result = '=?utf-8?q?Re:_[it=5Fissue3]_Ren=C3=A9s_[status=3Dfeedback]?='
        self.assertEqual(encode_header(src), result)

        src = 'Was machen\xc3\xbc und Fragezeichen?'
        result = '=?utf-8?q?Was_machen=C3=BC_und_Fragezeichen=3F?='
        self.assertEqual(encode_header(src), result)

def test_suite():
    suite = unittest.TestSuite()
    suite.addTest(unittest.makeSuite(RFC2822TestCase))
    return suite

Roundup Issue Tracker: http://roundup-tracker.org/