aboutsummaryrefslogtreecommitdiffstats
path: root/integrations
diff options
context:
space:
mode:
authorLauris BH <lauris@nix.lv>2018-02-18 22:06:37 +0200
committerGitHub <noreply@github.com>2018-02-18 22:06:37 +0200
commitae30315a62644774756df64af0ca1ef405853a57 (patch)
treece2b64280c81a52560a096260be1b851a781c6df /integrations
parent96c268c0fcc22604103f67821d66fef39944e80b (diff)
downloadgitea-ae30315a62644774756df64af0ca1ef405853a57.tar.gz
gitea-ae30315a62644774756df64af0ca1ef405853a57.zip
Fix escaping changed title in comments (#3530)
* Fix escaping changed title in comments * Fix escaping of wiki page titile Signed-off-by: Lauris Bukšis-Haberkorns <lauris@nix.lv>
Diffstat (limited to 'integrations')
-rw-r--r--integrations/pull_create_test.go41
-rw-r--r--integrations/pull_merge_test.go8
-rw-r--r--integrations/repo_activity_test.go6
3 files changed, 45 insertions, 10 deletions
diff --git a/integrations/pull_create_test.go b/integrations/pull_create_test.go
index 89abccf883..1d53aa3b6e 100644
--- a/integrations/pull_create_test.go
+++ b/integrations/pull_create_test.go
@@ -14,7 +14,7 @@ import (
"github.com/stretchr/testify/assert"
)
-func testPullCreate(t *testing.T, session *TestSession, user, repo, branch string) *httptest.ResponseRecorder {
+func testPullCreate(t *testing.T, session *TestSession, user, repo, branch, title string) *httptest.ResponseRecorder {
req := NewRequest(t, "GET", path.Join(user, repo))
resp := session.MakeRequest(t, req, http.StatusOK)
@@ -35,7 +35,7 @@ func testPullCreate(t *testing.T, session *TestSession, user, repo, branch strin
assert.True(t, exists, "The template has changed")
req = NewRequestWithValues(t, "POST", link, map[string]string{
"_csrf": htmlDoc.GetCSRF(),
- "title": "This is a pull title",
+ "title": title,
})
resp = session.MakeRequest(t, req, http.StatusFound)
@@ -47,7 +47,7 @@ func TestPullCreate(t *testing.T) {
session := loginUser(t, "user1")
testRepoFork(t, session, "user2", "repo1", "user1", "repo1")
testEditFile(t, session, "user1", "repo1", "master", "README.md", "Hello, World (Edited)\n")
- resp := testPullCreate(t, session, "user1", "repo1", "master")
+ resp := testPullCreate(t, session, "user1", "repo1", "master", "This is a pull title")
// check the redirected URL
url := resp.HeaderMap.Get("Location")
@@ -68,3 +68,38 @@ func TestPullCreate(t *testing.T) {
assert.Regexp(t, `Subject: \[PATCH\] Update 'README.md'`, resp.Body)
assert.NotRegexp(t, "diff.*diff", resp.Body) // not two diffs, just one
}
+
+func TestPullCreate_TitleEscape(t *testing.T) {
+ prepareTestEnv(t)
+ session := loginUser(t, "user1")
+ testRepoFork(t, session, "user2", "repo1", "user1", "repo1")
+ testEditFile(t, session, "user1", "repo1", "master", "README.md", "Hello, World (Edited)\n")
+ resp := testPullCreate(t, session, "user1", "repo1", "master", "<i>XSS PR</i>")
+
+ // check the redirected URL
+ url := resp.HeaderMap.Get("Location")
+ assert.Regexp(t, "^/user2/repo1/pulls/[0-9]*$", url)
+
+ // Edit title
+ req := NewRequest(t, "GET", url)
+ resp = session.MakeRequest(t, req, http.StatusOK)
+ htmlDoc := NewHTMLParser(t, resp.Body)
+ editTestTitleURL, exists := htmlDoc.doc.Find("#save-edit-title").First().Attr("data-update-url")
+ assert.True(t, exists, "The template has changed")
+
+ req = NewRequestWithValues(t, "POST", editTestTitleURL, map[string]string{
+ "_csrf": htmlDoc.GetCSRF(),
+ "title": "<u>XSS PR</u>",
+ })
+ session.MakeRequest(t, req, http.StatusOK)
+
+ req = NewRequest(t, "GET", url)
+ resp = session.MakeRequest(t, req, http.StatusOK)
+ htmlDoc = NewHTMLParser(t, resp.Body)
+ titleHTML, err := htmlDoc.doc.Find(".comments .event .text b").First().Html()
+ assert.NoError(t, err)
+ assert.Equal(t, "&lt;i&gt;XSS PR&lt;/i&gt;", titleHTML)
+ titleHTML, err = htmlDoc.doc.Find(".comments .event .text b").Next().Html()
+ assert.NoError(t, err)
+ assert.Equal(t, "&lt;u&gt;XSS PR&lt;/u&gt;", titleHTML)
+}
diff --git a/integrations/pull_merge_test.go b/integrations/pull_merge_test.go
index b123239331..aabb2c78fc 100644
--- a/integrations/pull_merge_test.go
+++ b/integrations/pull_merge_test.go
@@ -56,7 +56,7 @@ func TestPullMerge(t *testing.T) {
testRepoFork(t, session, "user2", "repo1", "user1", "repo1")
testEditFile(t, session, "user1", "repo1", "master", "README.md", "Hello, World (Edited)\n")
- resp := testPullCreate(t, session, "user1", "repo1", "master")
+ resp := testPullCreate(t, session, "user1", "repo1", "master", "This is a pull title")
elem := strings.Split(test.RedirectURL(resp), "/")
assert.EqualValues(t, "pulls", elem[3])
@@ -69,7 +69,7 @@ func TestPullRebase(t *testing.T) {
testRepoFork(t, session, "user2", "repo1", "user1", "repo1")
testEditFile(t, session, "user1", "repo1", "master", "README.md", "Hello, World (Edited)\n")
- resp := testPullCreate(t, session, "user1", "repo1", "master")
+ resp := testPullCreate(t, session, "user1", "repo1", "master", "This is a pull title")
elem := strings.Split(test.RedirectURL(resp), "/")
assert.EqualValues(t, "pulls", elem[3])
@@ -83,7 +83,7 @@ func TestPullSquash(t *testing.T) {
testEditFile(t, session, "user1", "repo1", "master", "README.md", "Hello, World (Edited)\n")
testEditFile(t, session, "user1", "repo1", "master", "README.md", "Hello, World (Edited!)\n")
- resp := testPullCreate(t, session, "user1", "repo1", "master")
+ resp := testPullCreate(t, session, "user1", "repo1", "master", "This is a pull title")
elem := strings.Split(test.RedirectURL(resp), "/")
assert.EqualValues(t, "pulls", elem[3])
@@ -96,7 +96,7 @@ func TestPullCleanUpAfterMerge(t *testing.T) {
testRepoFork(t, session, "user2", "repo1", "user1", "repo1")
testEditFileToNewBranch(t, session, "user1", "repo1", "master", "feature/test", "README.md", "Hello, World (Edited)\n")
- resp := testPullCreate(t, session, "user1", "repo1", "feature/test")
+ resp := testPullCreate(t, session, "user1", "repo1", "feature/test", "This is a pull title")
elem := strings.Split(test.RedirectURL(resp), "/")
assert.EqualValues(t, "pulls", elem[3])
diff --git a/integrations/repo_activity_test.go b/integrations/repo_activity_test.go
index 40983cbe1a..fcdbda2c89 100644
--- a/integrations/repo_activity_test.go
+++ b/integrations/repo_activity_test.go
@@ -22,16 +22,16 @@ func TestRepoActivity(t *testing.T) {
// Create PRs (1 merged & 2 proposed)
testRepoFork(t, session, "user2", "repo1", "user1", "repo1")
testEditFile(t, session, "user1", "repo1", "master", "README.md", "Hello, World (Edited)\n")
- resp := testPullCreate(t, session, "user1", "repo1", "master")
+ resp := testPullCreate(t, session, "user1", "repo1", "master", "This is a pull title")
elem := strings.Split(test.RedirectURL(resp), "/")
assert.EqualValues(t, "pulls", elem[3])
testPullMerge(t, session, elem[1], elem[2], elem[4], models.MergeStyleMerge)
testEditFileToNewBranch(t, session, "user1", "repo1", "master", "feat/better_readme", "README.md", "Hello, World (Edited Again)\n")
- testPullCreate(t, session, "user1", "repo1", "feat/better_readme")
+ testPullCreate(t, session, "user1", "repo1", "feat/better_readme", "This is a pull title")
testEditFileToNewBranch(t, session, "user1", "repo1", "master", "feat/much_better_readme", "README.md", "Hello, World (Edited More)\n")
- testPullCreate(t, session, "user1", "repo1", "feat/much_better_readme")
+ testPullCreate(t, session, "user1", "repo1", "feat/much_better_readme", "This is a pull title")
// Create issues (3 new issues)
testNewIssue(t, session, "user2", "repo1", "Issue 1", "Description 1")