view tools/load_tracker.py @ 8365:4ac0bbb3e440

bug(security): CVE-2025-53865 - XSS bug Extensive fixes in devel, responsive templates known to be exploitable. Similar constructs in classic and minimal templates not known to be exploitable, but changed anyway. doc/upgrading.txt: Reformat to 66 characters. Update with assigned CVE number. Add section on fixing tal:replace with unsafe data. Document analysis and assumptions in comment in file. doc/security.txt: Update with CVE number.
author John Rouillard <rouilj@ieee.org>
date Fri, 11 Jul 2025 19:30:27 -0400
parents e1dfd21f2252
children fed0f839c260
line wrap: on
line source

#! /usr/bin/env python
'''
Usage: %s <tracker home> <N>

Load up the indicated tracker with N issues and N/100 users.
'''

from __future__ import print_function
import sys, os, random
from roundup import instance

# open the instance
if len(sys.argv) < 2:
    print("Error: Not enough arguments")
    print(__doc__.strip()%(sys.argv[0]))
    sys.exit(1)
tracker_home = sys.argv[1]
N = int(sys.argv[2])

# open the tracker
tracker = instance.open(tracker_home)
db = tracker.open('admin')
db.tx_Source = "cli"

priorities = db.priority.list()
statuses = db.status.list()
resolved_id = db.status.lookup('resolved')
statuses.remove(resolved_id)

names = ['alpha', 'beta', 'gamma', 'delta', 'epsilon', 'zeta', 'eta', 
'theta', 'iota', 'kappa', 'lambda', 'mu', 'nu', 'xi', 'omicron', 'pi',
'rho']

titles = '''Lorem ipsum dolor sit amet, consectetuer adipiscing elit.
Duis nibh purus, bibendum sed, condimentum ut, bibendum ut, risus.
Fusce pede enim, nonummy sit amet, dapibus a, blandit eget, metus.
Nulla risus.
Vivamus tincidunt.
Donec consequat convallis quam.
Sed convallis vehicula felis.
Aliquam laoreet, dui quis pharetra vehicula, magna justo.
Euismod felis, eu adipiscing eros metus id tortor.
Suspendisse et turpis.
Aenean non felis.
Nam egestas eros.
Integer tellus quam, mattis ac, vestibulum sed, egestas quis, mauris.
Nulla tincidunt diam sit amet dui.
Nam odio mauris, dignissim vitae, eleifend eu, consectetuer id, risus.
Suspendisse potenti.
Donec tincidunt.
Vestibulum gravida.
Fusce luctus, neque id mattis fringilla, purus pede sodales pede.
Quis ultricies urna odio sed orci.'''.splitlines()

try:
    try:
        db.user.lookup('alpha0')
    except:
        # add some users
        M = N//100
        for i in range(M):
            print('\ruser', i, '       ', end=' ')
            sys.stdout.flush()
            if i//17 == 0:
                db.user.create(username=names[i%17])
            else:
                db.user.create(username=names[i%17]+str(i//17))

    # assignable user list
    users = db.user.list()
    users.remove(db.user.lookup('anonymous'))
    print()

    # now create the issues
    for i in range(N):
        print('\rissue', i, '       ', end=' ')
        sys.stdout.flush()
        # in practise, about 90% of issues are resolved
        if random.random() > .9:
            status = random.choice(statuses)
        else:
            status = resolved_id
        db.journaltag = db.user.get(random.choice(users), 'username')
        db.issue.create(
            title=random.choice(titles),
            priority=random.choice(priorities),
            status=status,
            assignedto=random.choice(users))
        if not i%1000:
            db.commit()
    print()

    db.commit()
finally:
    db.close()

# vim: set filetype=python ts=4 sw=4 et si

Roundup Issue Tracker: http://roundup-tracker.org/