#!/usr/bin/env python # -*- coding: utf-8 -*- # This test can be run stand-alone with something like: # > PYTHONPATH=. python2 openerp/tests/test_misc.py ############################################################################## # # OpenERP, Open Source Business Applications # Copyright (c) 2012-TODAY OpenERP S.A. # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as # published by the Free Software Foundation, either version 3 of the # License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . # ############################################################################## import unittest2 from . import test_mail_examples from openerp.tools import html_sanitize, html_email_clean, append_content_to_html, plaintext2html class TestSanitizer(unittest2.TestCase): """ Test the html sanitizer that filters html to remove unwanted attributes """ def test_basic_sanitizer(self): cases = [ ("yop", "

yop

"), # simple ("lala

yop

xxx", "

lala

yop

xxx

"), # trailing text ("Merci à l'intérêt pour notre produit.nous vous contacterons bientôt. Merci", u"

Merci à l'intérêt pour notre produit.nous vous contacterons bientôt. Merci

"), # unicode ] for content, expected in cases: html = html_sanitize(content) self.assertEqual(html, expected, 'html_sanitize is broken') def test_evil_malicious_code(self): # taken from https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Tests cases = [ ("

"), # no quotes and semicolons ("

"), # UTF-8 Unicode encoding ("

"), # hex encoding ("

"), # embedded carriage return ("

"), # embedded newline ("

"), # embedded tab ("

"), # embedded encoded tab ("

"), # spaces and meta-characters ("

\">"), # malformed tag (""), # non-alpha-non-digits (""), # non-alpha-non-digits ("<"), # extraneous open brackets ("