Projet

Général

Profil

0001-api-avoid-ending-up-with-unescaped-in-html-38033.patch

Valentin Deniaud, 28 novembre 2019 10:38

Télécharger (2,42 ko)

Voir les différences: 

Subject: [PATCH] api: avoid ending up with unescaped & in html (#38033)


 passerelle/utils/api.py        |  2 +-
 tests/test_generic_endpoint.py | 11 ++++++++++-
 2 files changed, 11 insertions(+), 2 deletions(-)
passerelle/utils/api.py
110 110 
        query_string = ''
111 111 
        query_parameters = self.get_query_parameters()
112 112 
        if query_parameters:
113 
            query_string = '?' + '&'.join(['%s=<i class="varname">%s</i>' % (x[0], x[0]) for x in query_parameters])
113 
            query_string = '?' + '&amp;'.join(['%s=<i class="varname">%s</i>' % (x[0], x[0]) for x in query_parameters])
114 114 

  		




  115
  115
  
    
        return mark_safe(url + query_string)

  		




  116
  116
  
    

  		












  

    
      tests/test_generic_endpoint.py
    
  





  184
  184
  
    
    def foo7(self, request, param1='a', param2='b', param3='c'):

  		




  185
  185
  
    
        pass

  		




  186
  186
  
    

  		




  
  187
  
    
    @endpoint(parameters={

  		




  
  188
  
    
        'test': {'description': 'test', 'example_value': 'test'},

  		




  
  189
  
    
        'reg': {'description': 'test', 'example_value': 'test'},

  		




  
  190
  
    
    })

  		




  
  191
  
    
    def foo8(self, request, test, reg):

  		




  
  192
  
    
        pass

  		




  
  193
  
    

  		




  
  194
  
    

  		




  187
  195
  
    
    @endpoint(cache_duration=10)

  		




  188
  196
  
    
    def cached_endpoint(self, request):

  		




  189
  197
  
    
        pass

  		




  ......




  191
  199
  
    

  		




  192
  200
  
    
def test_endpoint_decorator():

  		




  193
  201
  
    
    connector = FakeConnectorBase()

  		




  194
  
  
    
    for i in range(6):

  		




  
  202
  
    
    for i in range(8):

  		




  195
  203
  
    
        getattr(connector, 'foo%d' % (i + 1)).endpoint_info.object = connector

  		




  196
  204
  
    

  		




  197
  205
  
    
    assert connector.foo1.endpoint_info.name == 'foo1'

  		




  ......




  221
  229
  
    
    assert connector.foo5.endpoint_info.example_url_as_html() == '/fake/connector/foo5/test/'

  		




  222
  230
  
    
    assert connector.foo6.endpoint_info.example_url() == '/fake/connector/foo6/bar/'

  		




  223
  231
  
    
    assert connector.foo6.endpoint_info.example_url_as_html() == '/fake/connector/foo6/<i class="varname">param1</i>/'

  		




  
  232
  
    
    assert not '&reg' in connector.foo8.endpoint_info.example_url_as_html()

  		




  224
  233
  
    

  		




  225
  234
  
    
    connector.foo6.endpoint_info.pattern = None

  		




  226
  235
  
    
    connector.foo6.endpoint_info.example_pattern = None

  		




  227
  
  
    
-