|
Lines 185-191
subtest 'Display circulation table correctly' => sub {
Link Here
|
| 185 |
}; |
185 |
}; |
| 186 |
|
186 |
|
| 187 |
subtest 'XSS vulnerabilities in pagination' => sub { |
187 |
subtest 'XSS vulnerabilities in pagination' => sub { |
| 188 |
plan tests => 3; |
188 |
plan tests => 4; |
| 189 |
|
189 |
|
| 190 |
my $patron = $builder->build_object({ class => 'Koha::Patrons' }); |
190 |
my $patron = $builder->build_object({ class => 'Koha::Patrons' }); |
| 191 |
for ( 1 .. 30 ) { # We want the pagination to be displayed |
191 |
for ( 1 .. 30 ) { # We want the pagination to be displayed |
|
Lines 225-231
subtest 'XSS vulnerabilities in pagination' => sub {
Link Here
|
| 225 |
is( $alert_text, undef, 'No alert box displayed, even if evil intent' ); |
225 |
is( $alert_text, undef, 'No alert box displayed, even if evil intent' ); |
| 226 |
|
226 |
|
| 227 |
my $second_page = $driver->find_element('//div[@class="pages"]/span[@class="currentPage"]/following-sibling::a'); |
227 |
my $second_page = $driver->find_element('//div[@class="pages"]/span[@class="currentPage"]/following-sibling::a'); |
| 228 |
like( $second_page->get_attribute('href'), qr{category=1%22%3E%3Cscript%3Ealert%28%27booh%21%27%29%3C%2Fscript%3E}, 'The second patch should displayed the variables and attributes correctly URI escaped' ); |
228 |
unlike( $second_page->get_attribute('href'), qr{%22%3E%3Cscript%3Ealert%28%27booh%21%27%29%3C%2Fscript%3E}, 'The second page link should not contain any script tags (escaped or otherwise)' ); |
|
|
229 |
unlike( $second_page->get_attribute('href'), qr{"<script>alert('booh!')</script>}, 'The second page link should not contain any script tags (escaped or otherwise)' ); |
| 229 |
|
230 |
|
| 230 |
push @cleanup, $patron, $patron->category, $patron->library; |
231 |
push @cleanup, $patron, $patron->category, $patron->library; |
| 231 |
}; |
232 |
}; |
| 232 |
- |
|
|