view test/test_anypy.py @ 8062:28aa76443f58

fix(security): fix CVE-2024-39124, CVE-2024-39124, and CVE-2024-39125 Directions for fixing: * `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are vulnerable to an XSS attack. <CVE-2024-39124>` Requires fixing tracker homes. * `CVE-2024-39125`_ - :ref:`if Referer header is set to a script tag, it will be executed. <CVE-2024-39125>` Fixed in release 2.4.0, directions available for fixing in prior versions. * `CVE-2024-39126`_ - :ref:`PDF, XML and SVG files downloaded from an issue can contain embedded JavaScript which is executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions available for fixing in prior versions. prior to 2.4.0 release this weekend that fixes the last two CVE's.
author John Rouillard <rouilj@ieee.org>
date Tue, 09 Jul 2024 09:07:09 -0400
parents ebb03b8cee4d
children
line wrap: on
line source

"""Random tests for anypy modules"""


import unittest
from roundup.anypy.strings import repr_export, eval_import
from roundup.anypy.cmp_ import _test

import sys
_py3 = sys.version_info[0] > 2

class StringsTest(unittest.TestCase):

    def test_import_params(self):
        """ issue2551170 - handle long int in history/journal
            params tuple
        """
        # python2 export with id as number
        val = eval_import("('issue', 2345L, 'status')")
        self.assertSequenceEqual(val, ('issue', 2345, 'status'))

        # eval a tuple e.g. date representation
        val = eval_import("(2022, 9, 6, 3, 58, 4.776, 0, 0, 0)")
        self.assertSequenceEqual(val, (2022, 9, 6, 3, 58, 4.776, 0, 0, 0))

        # eval a boolean
        val = eval_import("False")
        self.assertEqual(val, False)
        val = eval_import("True")
        self.assertEqual(val, True)

        # check syntax error
        for testcase in ['true', '(2004, 10, 20', "2000, 10, 22)",
                         "test'", '"test']:
            with self.assertRaises(ValueError) as m:
                val = eval_import(testcase)
            print(m.exception)

        # python3 export with id as number
        val = eval_import("('issue', 2345, 'status')")
        self.assertSequenceEqual(val, ('issue', 2345, 'status'))

        # python2 or python3 export with id as string
        val = eval_import("('issue', '2345', 'status')")
        self.assertSequenceEqual(val, ('issue', '2345', 'status'))

    def test_export_params(self):
        """ issue2551170 - handle long int in history/journal
            params tuple
        """
        # python2 export with id as number
        if _py3:
            val = repr_export(('issue', 2345, 'status'))
            self.assertEqual(val, "('issue', 2345, 'status')")
        else:
            val = repr_export(('issue', long(2345), 'status'))
            self.assertEqual(val, "('issue', 2345L, 'status')")

        # python2 or python3 export with id as string
        val = repr_export(('issue', '2345', 'status'))
        self.assertEqual(val, "('issue', '2345', 'status')")
            
class MiscTest(unittest.TestCase):

    def test_cmp_(self):
        _test()

Roundup Issue Tracker: http://roundup-tracker.org/