Skip to content

Z
Zope
Commit bc41a5ee authored by Martin Häcker's avatar Martin Häcker
Browse files
Options

Merge remote-tracking branch 'upstream/2.13' into 2.13

parents ee53f2c4 eb8459d5
Hide whitespace changes
Inline Side-by-side
Showing with 25 additions and 4 deletions
.travis.yml 0 → 100644
View file @ bc41a5ee
language: python
python:
- "2.6"
- "2.7"
notifications:
email:
- hanno@hannosch.eu
install:
- python bootstrap.py
- bin/buildout
script:
- bin/test
src/OFS/tests/testFileAndImage.py
View file @ bc41a5ee
...@@ -336,7 +336,8 @@ class ImageTests(FileTests): ...@@ -336,7 +336,8 @@ class ImageTests(FileTests):
('<img src="http://foo/file" alt="" title="" height="16" width="16" />')) ('<img src="http://foo/file" alt="" title="" height="16" width="16" />'))
def testTag(self): def testTag(self):
tag_fmt = '<img src="http://foo/file" alt="%s" title="%s" height="16" width="16" />' tag_fmt = ('<img src="http://foo/file" alt="%s" title="%s" '
'height="16" width="16" />')
self.assertEqual(self.file.tag(), (tag_fmt % ('',''))) self.assertEqual(self.file.tag(), (tag_fmt % ('','')))
self.file.manage_changeProperties(title='foo') self.file.manage_changeProperties(title='foo')
self.assertEqual(self.file.tag(), (tag_fmt % ('','foo'))) self.assertEqual(self.file.tag(), (tag_fmt % ('','foo')))
...@@ -357,8 +358,13 @@ class ImageTests(FileTests): ...@@ -357,8 +358,13 @@ class ImageTests(FileTests):
class ImagePublishTests(Testing.ZopeTestCase.FunctionalTestCase): class ImagePublishTests(Testing.ZopeTestCase.FunctionalTestCase):
def testTagSafe(self): def testTagSafe(self):
self.app.manage_addImage("image", "") self.app.manage_addImage("image", "")
res = self.publish("/image/tag?height=0&width=0&css_class=%22%3E%3Cscript%20type%3D%22text%2Fjavascript%22%3Ealert('evil')%3B%3C%2Fscript%3E%3Cdiv%20class%3D%22") res = self.publish(
self.assertNotIn('<script type="text/javascript">alert(\'evil\');</script>', res.getBody()) "/image/tag?height=0&width=0&css_class=%22%3E%3Cscript%20type"
"%3D%22text%2Fjavascript%22%3Ealert('evil')%3B%3C%2Fscript"
"%3E%3Cdiv%20class%3D%22")
self.assertFalse(
'<script type="text/javascript">alert(\'evil\');</script>'
in res.getBody())
def test_suite(): def test_suite():
......
src/Products/Sessions/tests/testBrowserIdManager.py
View file @ bc41a5ee
...@@ -652,7 +652,7 @@ class TestBrowserIdManagerPublish(Testing.ZopeTestCase.FunctionalTestCase): ...@@ -652,7 +652,7 @@ class TestBrowserIdManagerPublish(Testing.ZopeTestCase.FunctionalTestCase):
res = self.publish( res = self.publish(
'/browser_id_manager/encodeUrl?url=%3Chtml%3EEVIL%2Fhtml%3E%3C!--') '/browser_id_manager/encodeUrl?url=%3Chtml%3EEVIL%2Fhtml%3E%3C!--')
self.assertNotIn("<html>EVIL/html>", res.getBody()) self.assertFalse("<html>EVIL/html>" in res.getBody())
class DummyObject: class DummyObject:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7