def _test_action(self, action): """ Test for XSS vulnerability in the given action Build a request with the given action, call the instructor dashboard view, and check that HTML code in a user's name is properly escaped. """ req = self._request_factory.post("dummy_url", data={"action": action}) req.user = self._instructor req.session = {} resp = legacy.instructor_dashboard(req, self._course.id) respUnicode = resp.content.decode(settings.DEFAULT_CHARSET) self.assertNotIn(self._evil_student.profile.name, respUnicode) self.assertIn(escape(self._evil_student.profile.name), respUnicode)
def _test_action(self, action): """ Test for XSS vulnerability in the given action Build a request with the given action, call the instructor dashboard view, and check that HTML code in a user's name is properly escaped. """ req = self._request_factory.post("dummy_url", data={"action": action}) req.user = self._instructor req.session = {} resp = legacy.instructor_dashboard(req, self._course.id) respUnicode = resp.content.decode(settings.DEFAULT_CHARSET) self.assertNotIn(self._evil_student.profile.name, respUnicode) self.assertIn(escape(self._evil_student.profile.name), respUnicode)