Projet

Général

Profil

0001-matomo-detect-html-tags-in-tracking_js-32948.patch

Lauréline Guérin, 04 février 2020 15:26

Télécharger (3,72 ko)

Voir les différences: 

Subject: [PATCH] matomo: detect html tags in tracking_js (#32948)


 hobo/matomo/forms.py       |  8 ++++++++
 tests/test_matomo_views.py | 39 +++++++++++++++++++++++---------------
 2 files changed, 32 insertions(+), 15 deletions(-)
hobo/matomo/forms.py
17 17 
from django import forms
18 18 
from django.utils.translation import ugettext_lazy as _
19 19 

  		




  
  20
  
    
import lxml.html

  		




  
  21
  
    

  		




  20
  22
  
    

  		




  21
  23
  
    
class SettingsForm(forms.Form):

  		




  22
  24
  
    
    """

  		




  ......




  31
  33
  
    
        required=False,

  		




  32
  34
  
    
        widget=forms.Textarea())

  		




  33
  35
  
    

  		




  
  36
  
    
    def clean_tracking_js(self):

  		




  
  37
  
    
        value = self.cleaned_data['tracking_js']

  		




  
  38
  
    
        if lxml.html.fromstring(value).find('.//*'):

  		




  
  39
  
    
            raise forms.ValidationError('Remove html tags.')

  		




  
  40
  
    
        return value

  		




  
  41
  
    

  		




  34
  42
  
    

  		




  35
  43
  
    
class EnableForm(forms.Form):

  		




  36
  44
  
    
    pass

  		












  

    
      tests/test_matomo_views.py
    
  





  123
  123
  
    
    app = login(TestApp(application))

  		




  124
  124
  
    

  		




  125
  125
  
    
    # get matomo's validation page

  		




  126
  
  
    
    resp1 = app.get('/visits-tracking/enable-manual', status=200)

  		




  127
  
  
    
    assert re.search('<textarea.* name="tracking_js"', resp1.body)

  		




  
  126
  
    
    resp = app.get('/visits-tracking/enable-manual', status=200)

  		




  
  127
  
    
    assert re.search('<textarea.* name="tracking_js"', resp.body)

  		




  128
  128
  
    

  		




  129
  129
  
    
    # validate and get matomo's home page

  		




  130
  
  
    
    resp1.form['tracking_js'] = '...js_code_1...'

  		




  131
  
  
    
    resp2 = resp1.form.submit().follow()

  		




  132
  
  
    
    assert resp2.body.find('Manual configuration.')

  		




  133
  
  
    
    assert re.search('<textarea.* name="tracking_js"', resp2.body)

  		




  134
  
  
    
    assert resp2.body.find('...js_code_1...</textarea>') != -1

  		




  135
  
  
    
    assert resp2.body.find('<button class="submit-button">Save</button>') != -1

  		




  
  130
  
    
    resp.form['tracking_js'] = '...js_code_1...'

  		




  
  131
  
    
    resp = resp.form.submit().follow()

  		




  
  132
  
    
    assert resp.body.find('Manual configuration.')

  		




  
  133
  
    
    assert re.search('<textarea.* name="tracking_js"', resp.body)

  		




  
  134
  
    
    assert resp.body.find('...js_code_1...</textarea>') != -1

  		




  
  135
  
    
    assert resp.body.find('<button class="submit-button">Save</button>') != -1

  		




  136
  136
  
    

  		




  137
  137
  
    
    # update JS code on matomo's home page

  		




  138
  
  
    
    resp2.form['tracking_js'] = '...js_code_2...'

  		




  139
  
  
    
    resp3 = resp2.form.submit().follow()

  		




  140
  
  
    
    assert resp3.body.find('Manual configuration.') != -1

  		




  141
  
  
    
    assert re.search('<textarea.* name="tracking_js"', resp3.body)

  		




  142
  
  
    
    assert resp3.body.find('...js_code_2...</textarea>') != -1

  		




  143
  
  
    
    assert resp3.body.find('<button class="submit-button">Save</button>') != -1

  		




  144
  
  
    
    assert resp3.body.find('Good respect of user rights') != -1

  		




  
  138
  
    
    resp.form['tracking_js'] = '...js_code_2...'

  		




  
  139
  
    
    resp = resp.form.submit().follow()

  		




  
  140
  
    
    assert resp.body.find('Manual configuration.') != -1

  		




  
  141
  
    
    assert re.search('<textarea.* name="tracking_js"', resp.body)

  		




  
  142
  
    
    assert resp.body.find('...js_code_2...</textarea>') != -1

  		




  
  143
  
    
    assert resp.body.find('<button class="submit-button">Save</button>') != -1

  		




  
  144
  
    
    assert resp.body.find('Good respect of user rights') != -1

  		




  
  145
  
    

  		




  
  146
  
    
    # check html tags

  		




  
  147
  
    
    resp.form['tracking_js'] = '<script>...js_code_2...</script>'

  		




  
  148
  
    
    resp = resp.form.submit()

  		




  
  149
  
    
    assert '<ul class="errorlist"><li>Remove html tags.</li></ul>' in resp.text

  		




  
  150
  
    
    resp.form['tracking_js'] = '<script >'

  		




  
  151
  
    
    resp = resp.form.submit()

  		




  
  152
  
    
    assert '<ul class="errorlist"><li>Remove html tags.</li></ul>' in resp.text

  		




  
  153
  
    

  		




  145
  154
  
    

  		




  146
  155
  
    
def test_available_options(admin_user):

  		




  147
  156
  
    
    """check available buttons (manual/automatic configurations)"""

  		




  148
  
  
    
-