view roundup/test/mocknull.py @ 8356:63390dcfcfe9

bug: fix template use of structure with untrusted data Looks like an xSS bug with an early version of the template that was fixed in the code but never in the deployed tracker. It has been a while since this particular construct has been in the classic template which is the base for the tracker. This has been fixed on the deployed tracker as well. reported by 4bug of ChaMd5 Security Team H1 Group
author John Rouillard <rouilj@ieee.org>
date Tue, 08 Jul 2025 10:23:09 -0400
parents 617d85ce4ac3
children
line wrap: on
line source


class MockNull:
    def __init__(self, **kwargs):
        for key, value in kwargs.items():
            self.__dict__[key] = value

    def __call__(self, *args, **kwargs): return MockNull()

    def __getattr__(self, name):
        # This allows assignments which assume all intermediate steps are Null
        # objects if they don't exist yet.
        #
        # For example (with just 'client' defined):
        #
        # client.db.config.TRACKER_WEB = 'BASE/'
        self.__dict__[name] = MockNull()
        return getattr(self, name)

    def __getitem__(self, key): return self

    def __bool__(self): return False
    # Python 2 compatibility:
    __nonzero__ = __bool__

    def __contains__(self, key): return False

    def __eq__(self, rhs): return False

    def __ne__(self, rhs): return False

    def __str__(self): return ''

    def __repr__(self): return '<MockNull 0x%x>' % id(self)

    def gettext(self, string): return string

    _ = gettext

    def get(self, name, default=None):
        try:
            return self.__dict__[name.lower()]
        except KeyError:
            return default

Roundup Issue Tracker: http://roundup-tracker.org/