Mercurial > p > roundup > code
view test/test_rfc2822.py @ 4851:24b8011cd2dc
Fix XSS in issue2550817
Note that the code that triggers that particular bug is no longer in
roundup core. But the change to the templates we suggest is a *lot*
safer as it always escapes the error and ok messages now.
If you are upgrading: you *MUST* read doc/upgrading.txt and do the
necessary changes to your templates, the escaping now happens in the
template and not in the roundup code. So if you don't make the necessary
changes *you are vulnerable*.
| author | Ralf Schlatterbeck <rsc@runtux.com> |
|---|---|
| date | Fri, 20 Dec 2013 18:24:10 +0100 |
| parents | 97f9fc0bc0ea |
| children |
line wrap: on
line source
from roundup.rfc2822 import decode_header, encode_header import unittest, time class RFC2822TestCase(unittest.TestCase): def testDecode(self): src = 'Re: [it_issue3] '\ '=?ISO-8859-1?Q?Ren=E9s_[resp=3Dg=2Cstatus=3D?= '\ '=?ISO-8859-1?Q?feedback]?=' result = 'Re: [it_issue3] Ren\xc3\xa9s [resp=g,status=feedback]' self.assertEqual(decode_header(src), result) src = 'Re: [it_issue3]'\ ' =?ISO-8859-1?Q?Ren=E9s_[resp=3Dg=2Cstatus=3D?=' \ ' =?ISO-8859-1?Q?feedback]?=' result = 'Re: [it_issue3] Ren\xc3\xa9s [resp=g,status=feedback]' self.assertEqual(decode_header(src), result) def testEncode(self): src = 'Re: [it_issue3] Ren\xc3\xa9s [status=feedback]' result = '=?utf-8?q?Re:_[it=5Fissue3]_Ren=C3=A9s_[status=3Dfeedback]?=' self.assertEqual(encode_header(src), result) src = 'Was machen\xc3\xbc und Fragezeichen?' result = '=?utf-8?q?Was_machen=C3=BC_und_Fragezeichen=3F?=' self.assertEqual(encode_header(src), result) def test_suite(): suite = unittest.TestSuite() suite.addTest(unittest.makeSuite(RFC2822TestCase)) return suite
