Projet

Général

Profil

0001-matomo-detect-html-tags-in-tracking_js-32948.patch

Lauréline Guérin, 10 février 2020 10:21

Télécharger (4,03 ko)

Voir les différences: 

Subject: [PATCH] matomo: detect html tags in tracking_js (#32948)


 hobo/matomo/forms.py       |  6 ++++++
 tests/test_matomo_views.py | 42 +++++++++++++++++++++++---------------
 2 files changed, 31 insertions(+), 17 deletions(-)
hobo/matomo/forms.py
31 31 
        required=False,
32 32 
        widget=forms.Textarea())
33 33 

  		




  
  34
  
    
    def clean_tracking_js(self):

  		




  
  35
  
    
        value = self.cleaned_data['tracking_js']

  		




  
  36
  
    
        if '<script' in value:

  		




  
  37
  
    
            raise forms.ValidationError('Please remove the "<script>" HTML tag.')

  		




  
  38
  
    
        return value

  		




  
  39
  
    

  		




  34
  40
  
    

  		




  35
  41
  
    
class EnableForm(forms.Form):

  		




  36
  42
  
    
    pass

  		












  

    
      tests/test_matomo_views.py
    
  





  7
  7
  
    
from requests import Response

  		




  8
  8
  
    
from webtest import TestApp

  		




  9
  9
  
    

  		




  10
  
  
    
from django.conf import settings

  		




  11
  10
  
    
from django.contrib.auth.models import User

  		




  12
  11
  
    
from django.test import override_settings

  		




  13
  12
  
    

  		




  14
  
  
    
from hobo.environment.models import Variable, Wcs, Combo, Fargo

  		




  
  13
  
    
from hobo.environment.models import Wcs, Combo, Fargo

  		




  15
  14
  
    
from hobo.wsgi import application

  		




  16
  15
  
    

  		




  17
  16
  
    
pytestmark = pytest.mark.django_db

  		




  ......




  123
  122
  
    
    app = login(TestApp(application))

  		




  124
  123
  
    

  		




  125
  124
  
    
    # get matomo's validation page

  		




  126
  
  
    
    resp1 = app.get('/visits-tracking/enable-manual', status=200)

  		




  127
  
  
    
    assert re.search('<textarea.* name="tracking_js"', resp1.body)

  		




  
  125
  
    
    resp = app.get('/visits-tracking/enable-manual', status=200)

  		




  
  126
  
    
    assert re.search('<textarea.* name="tracking_js"', resp.body)

  		




  128
  127
  
    

  		




  129
  128
  
    
    # validate and get matomo's home page

  		




  130
  
  
    
    resp1.form['tracking_js'] = '...js_code_1...'

  		




  131
  
  
    
    resp2 = resp1.form.submit().follow()

  		




  132
  
  
    
    assert resp2.body.find('Manual configuration.')

  		




  133
  
  
    
    assert re.search('<textarea.* name="tracking_js"', resp2.body)

  		




  134
  
  
    
    assert resp2.body.find('...js_code_1...</textarea>') != -1

  		




  135
  
  
    
    assert resp2.body.find('<button class="submit-button">Save</button>') != -1

  		




  
  129
  
    
    resp.form['tracking_js'] = '...js_code_1...'

  		




  
  130
  
    
    resp = resp.form.submit().follow()

  		




  
  131
  
    
    assert resp.body.find('Manual configuration.')

  		




  
  132
  
    
    assert re.search('<textarea.* name="tracking_js"', resp.body)

  		




  
  133
  
    
    assert resp.body.find('...js_code_1...</textarea>') != -1

  		




  
  134
  
    
    assert resp.body.find('<button class="submit-button">Save</button>') != -1

  		




  136
  135
  
    

  		




  137
  136
  
    
    # update JS code on matomo's home page

  		




  138
  
  
    
    resp2.form['tracking_js'] = '...js_code_2...'

  		




  139
  
  
    
    resp3 = resp2.form.submit().follow()

  		




  140
  
  
    
    assert resp3.body.find('Manual configuration.') != -1

  		




  141
  
  
    
    assert re.search('<textarea.* name="tracking_js"', resp3.body)

  		




  142
  
  
    
    assert resp3.body.find('...js_code_2...</textarea>') != -1

  		




  143
  
  
    
    assert resp3.body.find('<button class="submit-button">Save</button>') != -1

  		




  144
  
  
    
    assert resp3.body.find('Good respect of user rights') != -1

  		




  
  137
  
    
    resp.form['tracking_js'] = '...js_code_2...'

  		




  
  138
  
    
    resp = resp.form.submit().follow()

  		




  
  139
  
    
    assert resp.body.find('Manual configuration.') != -1

  		




  
  140
  
    
    assert re.search('<textarea.* name="tracking_js"', resp.body)

  		




  
  141
  
    
    assert resp.body.find('...js_code_2...</textarea>') != -1

  		




  
  142
  
    
    assert resp.body.find('<button class="submit-button">Save</button>') != -1

  		




  
  143
  
    
    assert resp.body.find('Good respect of user rights') != -1

  		




  
  144
  
    

  		




  
  145
  
    
    # check html tags

  		




  
  146
  
    
    resp.form['tracking_js'] = '<script>...js_code_2...</script>'

  		




  
  147
  
    
    resp = resp.form.submit()

  		




  
  148
  
    
    assert '<ul class="errorlist"><li>Please remove the &quot;&lt;script&gt;&quot; HTML tag.</li></ul>' in resp.text

  		




  
  149
  
    
    resp.form['tracking_js'] = '<script >'

  		




  
  150
  
    
    resp = resp.form.submit()

  		




  
  151
  
    
    assert '<ul class="errorlist"><li>Please remove the &quot;&lt;script&gt;&quot; HTML tag.</li></ul>' in resp.text

  		




  
  152
  
    

  		




  145
  153
  
    

  		




  146
  154
  
    
def test_available_options(admin_user):

  		




  147
  155
  
    
    """check available buttons (manual/automatic configurations)"""

  		




  148
  
  
    
-