From cbe6d5568f4f5053ed7228ca3c3d0cce77cf9560 Mon Sep 17 00:00:00 2001 From: Jacob Kaplan-Moss Date: Tue, 13 Aug 2013 11:06:41 -0500 Subject: Apply autoescaping to AdminURLFieldWidget. This is a security fix; disclosure to follow shortly. --- tests/admin_widgets/tests.py | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) (limited to 'tests/admin_widgets') diff --git a/tests/admin_widgets/tests.py b/tests/admin_widgets/tests.py index 5a88df1e57..9f5abe0684 100644 --- a/tests/admin_widgets/tests.py +++ b/tests/admin_widgets/tests.py @@ -321,18 +321,24 @@ class AdminURLWidgetTest(DjangoTestCase): w = widgets.AdminURLFieldWidget() self.assertHTMLEqual( conditional_escape(w.render('test', 'http://example-äüö.com')), - '

Currently:http://example-äüö.com
Change:

' + '

Currently: http://example-äüö.com
Change:

' ) def test_render_quoting(self): + # WARNING: Don't use assertHTMLEqual in that testcase! + # assertHTMLEqual will get rid of some escapes which are tested here! w = widgets.AdminURLFieldWidget() - self.assertHTMLEqual( - conditional_escape(w.render('test', 'http://example.com/some text')), - '

Currently:http://example.com/<sometag>some text</sometag>
Change:

' + self.assertEqual( + w.render('test', 'http://example.com/some text'), + '

Currently: http://example.com/<sometag>some text</sometag>
Change:

' ) - self.assertHTMLEqual( - conditional_escape(w.render('test', 'http://example-äüö.com/some text')), - '

Currently:http://example-äüö.com/<sometag>some text</sometag>
Change:

' + self.assertEqual( + w.render('test', 'http://example-äüö.com/some text'), + '

Currently: http://example-äüö.com/<sometag>some text</sometag>
Change:

' + ) + self.assertEqual( + w.render('test', 'http://www.example.com/%C3%A4">"'), + '

Currently: http://www.example.com/%C3%A4"><script>alert("XSS!")</script>"
Change:

' ) -- cgit v1.3