Fixed #15182 - Fixed a security issue with ClearableFileInput. Disclosure and new release forthcoming.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@15470 bcc190cf-cafb-0310-a4f2-bffc1f526a37

1 files changed, 22 insertions, 0 deletions

diff --git a/tests/regressiontests/forms/tests/widgets.py b/tests/regressiontests/forms/tests/widgets.py
index 7d2b633778..4c5aeb0147 100644
--- a/tests/regressiontests/forms/tests/widgets.py
+++ b/tests/regressiontests/forms/tests/widgets.py
@@ -1086,6 +1086,28 @@ class ClearableFileInputTests(TestCase):
         self.assertEqual(widget.render('myfile', FakeFieldFile()),
                          u'Currently: <a href="something">something</a> <input type="checkbox" name="myfile-clear" id="myfile-clear_id" /> <label for="myfile-clear_id">Clear</label><br />Change: <input type="file" name="myfile" />')
 
+    def test_html_escaped(self):
+        """
+        A ClearableFileInput should escape name, filename and URL when
+        rendering HTML. Refs #15182.
+        """
+
+        class StrangeFieldFile(object):
+            url = "something?chapter=1&sect=2&copy=3&lang=en"
+
+            def __unicode__(self):
+                return u'''something<div onclick="alert('oops')">.jpg'''
+
+        widget = ClearableFileInput()
+        field = StrangeFieldFile()
+        output = widget.render('my<div>file', field)
+        self.assertFalse(field.url in output)
+        self.assertTrue(u'href="something?chapter=1&amp;sect=2&amp;copy=3&amp;lang=en"' in output)
+        self.assertFalse(unicode(field) in output)
+        self.assertTrue(u'something&lt;div onclick=&quot;alert(&#39;oops&#39;)&quot;&gt;.jpg' in output)
+        self.assertTrue(u'my&lt;div&gt;file' in output)
+        self.assertFalse(u'my<div>file' in output)
+
     def test_clear_input_renders_only_if_not_required(self):
         """
         A ClearableFileInput with is_required=False does not render a clear