Mercurial > p > roundup > code
view test/test_anypy.py @ 8062:28aa76443f58
fix(security): fix CVE-2024-39124, CVE-2024-39124, and CVE-2024-39125
Directions for fixing:
* `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are
vulnerable to an XSS attack. <CVE-2024-39124>` Requires fixing
tracker homes.
* `CVE-2024-39125`_ - :ref:`if Referer header is set to a script
tag, it will be executed. <CVE-2024-39125>` Fixed in release 2.4.0,
directions available for fixing in prior versions.
* `CVE-2024-39126`_ - :ref:`PDF, XML and SVG files downloaded from
an issue can contain embedded JavaScript which is
executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions
available for fixing in prior versions.
prior to 2.4.0 release this weekend that fixes the last two CVE's.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 09 Jul 2024 09:07:09 -0400 |
| parents | ebb03b8cee4d |
| children |
line wrap: on
line source
"""Random tests for anypy modules""" import unittest from roundup.anypy.strings import repr_export, eval_import from roundup.anypy.cmp_ import _test import sys _py3 = sys.version_info[0] > 2 class StringsTest(unittest.TestCase): def test_import_params(self): """ issue2551170 - handle long int in history/journal params tuple """ # python2 export with id as number val = eval_import("('issue', 2345L, 'status')") self.assertSequenceEqual(val, ('issue', 2345, 'status')) # eval a tuple e.g. date representation val = eval_import("(2022, 9, 6, 3, 58, 4.776, 0, 0, 0)") self.assertSequenceEqual(val, (2022, 9, 6, 3, 58, 4.776, 0, 0, 0)) # eval a boolean val = eval_import("False") self.assertEqual(val, False) val = eval_import("True") self.assertEqual(val, True) # check syntax error for testcase in ['true', '(2004, 10, 20', "2000, 10, 22)", "test'", '"test']: with self.assertRaises(ValueError) as m: val = eval_import(testcase) print(m.exception) # python3 export with id as number val = eval_import("('issue', 2345, 'status')") self.assertSequenceEqual(val, ('issue', 2345, 'status')) # python2 or python3 export with id as string val = eval_import("('issue', '2345', 'status')") self.assertSequenceEqual(val, ('issue', '2345', 'status')) def test_export_params(self): """ issue2551170 - handle long int in history/journal params tuple """ # python2 export with id as number if _py3: val = repr_export(('issue', 2345, 'status')) self.assertEqual(val, "('issue', 2345, 'status')") else: val = repr_export(('issue', long(2345), 'status')) self.assertEqual(val, "('issue', 2345L, 'status')") # python2 or python3 export with id as string val = repr_export(('issue', '2345', 'status')) self.assertEqual(val, "('issue', '2345', 'status')") class MiscTest(unittest.TestCase): def test_cmp_(self): _test()
