def test_render_no_xss(self):
from adhocracy.lib.text import render
source = '<script>XSS</script><a></a>'
result = render(source, substitutions=False)
self.assertEquals(result[:3], '<p>')
self.assertEquals(result[-4:], '</p>')
core_result = result[3:-4]
self.assertTrue(u'<' not in core_result)
def test_render_no_xss(self):
from adhocracy.lib.text import render
source = '<script>XSS</script><a></a>'
result = render(source, substitutions=False)
self.assertEquals(result[:3], '<p>')
self.assertEquals(result[-4:], '</p>')
core_result = result[3:-4]
self.assertTrue(u'<' not in core_result)
def text(self):
text = None
try:
if self.event:
from adhocracy.lib.text import render
text = self.event.text(self)
text = render(text)
except AttributeError, ae:
log.exception("Creating event text", ae)
def test_render_no_xss_substitutions(self):
from adhocracy.lib.text import render
tt_make_user('<foo>')
source = '@<foo>'
result = render(source, substitutions=True)
self.assertEquals(result[:3], '<p>')
self.assertEquals(result[-4:], '</p>')
core_result = result[3:-4]
self.assertTrue(u'<' not in core_result)
def test_html_sanitizing(self):
from adhocracy.lib.text import render
result = render(SANITIZE_TEST_STRING, safe_mode='adhocracy_config',
_testing_allow_user_html=True)
self.assertTrue('<script' not in result)
self.assertTrue('<object' not in result)
self.assertTrue('<embed' not in result)
self.assertTrue('javascript' not in result)
self.assertTrue('<iframe' in result)
def test_render_no_xss_substitutions(self):
from adhocracy.lib.text import render
tt_make_user('<foo>')
source = '@<foo>'
result = render(source, substitutions=True)
self.assertEquals(result[:3], '<p>')
self.assertEquals(result[-4:], '</p>')
core_result = result[3:-4]
self.assertTrue(u'<' not in core_result)
def test_html_sanitizing(self):
from adhocracy.lib.text import render
result = render(SANITIZE_TEST_STRING,
safe_mode='adhocracy_config',
_testing_allow_user_html=True)
self.assertTrue('<script' not in result)
self.assertTrue('<object' not in result)
self.assertTrue('<embed' not in result)
self.assertTrue('javascript' not in result)
self.assertTrue('<iframe' in result)
def test_html_sanitizing(self):
from adhocracy.lib.text import render
source = '<h1>Hello</h1><script>XSS</script>' \
'<object>include_dangerous</object>' \
'<embed>include_dangerous</embed>' \
'<a href="javascript:bar()" onclick="javascript: alert(\'foo\')">lala</a>' \
'<iframe class="youtube-player" type="text/html" width="640" height="385"' \
' src="http://www.youtube.com/embed/foo" frameborder="0">' \
'</iframe>'
result = render(source, safe_mode='adhocracy_config', _testing_allow_user_html=True)
self.assertTrue('<script' not in result)
self.assertTrue('<object' not in result)
self.assertTrue('<embed' not in result)
self.assertTrue('javascript' not in result)
self.assertTrue('<iframe' in result)
def test_render_user_substitution(self):
from adhocracy.lib.text import render
tt_make_user('pudo')
source = '@pudo'
result = render(source, substitutions=True)
self.assertTrue(u'/user/pudo"' in result)
def test_render_no_substitution(self):
from adhocracy.lib.text import render
tt_make_user('pudo')
source = '@pudo'
result = render(source, substitutions=False)
self.assertEqual(result, u'<p>@pudo</p>')
def test_render(self):
from adhocracy.lib.text import render
source = ('header\n'
'========')
result = render(source)
self.assertEqual(result, u'<h1>header</h1>')
def description(self):
if self.instance.description:
return text.render(self.instance.description, escape=False)
return ""
def render(self):
from adhocracy.lib import text
if self.page.function == self.page.NORM:
return text.render_line_based(self)
return text.render(self.text)
def text(self):
if self.milestone.text:
return text.render(self.milestone.text, escape=False)
return ""
def test_render_markdown_vuln(self):
from adhocracy.lib.text import render
source = u'[XSS](javascript://%0Aalert%28\'XSS\'%29;)'
result = render(source)
self.assertTrue(u'javascript' not in result)
def test_render_user_substitution(self):
from adhocracy.lib.text import render
tt_make_user('pudo')
source = '@pudo'
result = render(source, substitutions=True)
self.assertTrue(u'http://test.lan/user/pudo"' in result)
def test_render_no_substitution(self):
from adhocracy.lib.text import render
tt_make_user('pudo')
source = '@pudo'
result = render(source, substitutions=False)
self.assertEqual(result, u'<p>@pudo</p>\n')
def text(self):
if self.comment and self.comment.latest:
return text.render(self.comment.latest.text)
return ""
def _bio(self):
if self.user.bio:
return text.render(self.user.bio)
return ""
def text(self):
if self.milestone.text:
return text.render(self.milestone.text,
safe_mode='adhocracy_config')
return ""
def description(self):
if self.instance.description:
return text.render(self.instance.description, escape=False)
return ""
def test_render_markdown_vuln(self):
from adhocracy.lib.text import render
source = u'[XSS](javascript://%0Aalert%28\'XSS\'%29;)'
result = render(source)
self.assertTrue(u'javascript' not in result)
def render(self, line_based=False):
from adhocracy.lib import text
if line_based:
return text.render_line_based(self)
else:
return text.render(self.text)
def test_render(self):
from adhocracy.lib.text import render
source = ('header\n'
'========')
result = render(source)
self.assertEqual(result, u'<h1>header</h1>\n')
def render(self, line_based=False):
from adhocracy.lib import text
if line_based:
return text.render_line_based(self)
else:
return text.render(self.text)
def _bio(self):
if self.user.bio:
return text.render(self.user.bio)
return ""
def text(self):
if self.comment and self.comment.latest:
return text.render(self.comment.latest.text)
return ""
def description(self):
if self.instance.description:
return text.render(self.instance.description,
safe_mode='adhocracy_config')
return ""
def test_usercontent(self):
from adhocracy.lib.text import render
r = render(u'[link](http://example.com/)')
self.assertTrue(u'href="http://example' not in r)
def text(self):
if self.milestone.text:
return text.render(self.milestone.text,
safe_mode='adhocracy_config')
return ""
def description(self):
if self.instance.description:
return text.render(self.instance.description,
safe_mode='adhocracy_config')
return ""
def render(self):
from adhocracy.lib import text
if self.page.function == self.page.NORM:
return text.render_line_based(self)
return text.render(self.text)