Backport test of reStructuredText security fixes.

1bebfac8 · Tres Seaver · 0b3e409f · 1bebfac8 · 1bebfac8
Commit 1bebfac8 authored Jul 10, 2006 by Tres Seaver
Showing with 54 additions and 1 deletion

lib/python/Products/ZReST/tests/test_ZReST.py lib/python/Products/ZReST/tests/test_ZReST.py +28 -1

lib/python/reStructuredText/tests/testReST.py lib/python/reStructuredText/tests/testReST.py +26 -0

No files found.
--- a/lib/python/Products/ZReST/tests/test_ZReST.py
+++ b/lib/python/Products/ZReST/tests/test_ZReST.py
@@ -56,13 +56,40 @@ class TestZReST(unittest.TestCase):
        s = '<h1><a id="hello-world" name="hello-world">Hello World</a></h1>'
        self.assertEqual(s in html, True)

-        s = '<h1><a id="von-v-geln-und-fen" name="von-v-geln-und-fen">Von Vgeln und fen</a></h1>'
+        s = '<h1><a id="von-v-geln-und-fen" name="von-v-geln-und-fen">'\
+            'Von Vgeln und fen</a></h1>'
        self.assertEqual(s in html, True)

        # ZReST should render a complete HTML document
        self.assertEqual('<html' in html, True)
        self.assertEqual('<body>' in html, True)

+    def test_include_directive_raises(self):
+        resty = self._makeOne()
+        resty.source = 'hello world\n .. include:: /etc/passwd'
+        self.assertRaises(NotImplementedError, resty.render)
+
+    def test_raw_directive_disabled(self):
+
+        EXPECTED = '<h1>HELLO WORLD</h1>'
+
+        resty = self._makeOne()
+        resty.source = '.. raw:: html\n\n  %s\n' % EXPECTED
+        result = resty.render() # don't raise, but don't work either
+        self.failIf(EXPECTED in result)
+
+    def test_raw_directive_file_directive_raises(self):
+
+        resty = self._makeOne()
+        resty.source = '.. raw:: html\n  :file: inclusion.txt'
+        self.assertRaises(NotImplementedError, resty.render)
+
+    def test_raw_directive_url_directive_raises(self):
+
+        resty = self._makeOne()
+        resty.source = '.. raw:: html\n  :url: http://www.zope.org/'
+        self.assertRaises(NotImplementedError, resty.render)
+

 def test_suite():
    suite = unittest.TestSuite()

--- a/lib/python/reStructuredText/tests/testReST.py
+++ b/lib/python/reStructuredText/tests/testReST.py
@@ -82,6 +82,32 @@ text
        self.assertEquals(output, expected) 


+    def test_include_directive_raises(self):
+        source = 'hello world\n .. include:: /etc/passwd'
+        self.assertRaises(NotImplementedError, HTML, source)
+
+    def test_raw_directive_disabled(self):
+
+        EXPECTED = '<h1>HELLO WORLD</h1>'
+
+        source = '.. raw:: html\n\n  %s\n' % EXPECTED
+        result = HTML(source)       # don't raise, but don't work either
+        self.failIf(EXPECTED in result)
+
+        self.failUnless("&quot;raw&quot; directive disabled" in result)
+        from cgi import escape
+        self.failUnless(escape(EXPECTED) in result)
+
+    def test_raw_directive_file_option_raises(self):
+
+        source = '.. raw:: html\n  :file: inclusion.txt'
+        self.assertRaises(NotImplementedError, HTML, source)
+
+    def test_raw_directive_url_option_raises(self):
+
+        source = '.. raw:: html\n  :url: http://www.zope.org'
+        self.assertRaises(NotImplementedError, HTML, source)
+
 def test_suite():
    from unittest import TestSuite, makeSuite
    return TestSuite((makeSuite(TestReST),))