Bugzilla – Attachment 175686 Details for
Bug 38467
Template::Toolkit filters can create risky Javascript when not using RFC3986
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38467: Add test
Bug-38467-Add-test.patch (text/plain), 1.82 KB, created by
Victor Grousset/tuxayo
on 2024-12-19 09:26:13 UTC
(
hide
)
Description:
Bug 38467: Add test
Filename:
MIME Type:
Creator:
Victor Grousset/tuxayo
Created:
2024-12-19 09:26:13 UTC
Size:
1.82 KB
patch
obsolete
>From f8aa16f771423b2d767d242543202f833529bb93 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 20 Nov 2024 09:57:06 +0100 >Subject: [PATCH] Bug 38467: Add test > >Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> >--- > t/db_dependent/Templates.t | 26 +++++++++++++++++++++++++- > 1 file changed, 25 insertions(+), 1 deletion(-) > >diff --git a/t/db_dependent/Templates.t b/t/db_dependent/Templates.t >index ebab637078..aa1785d226 100755 >--- a/t/db_dependent/Templates.t >+++ b/t/db_dependent/Templates.t >@@ -19,11 +19,12 @@ use Modern::Perl; > > use CGI; > >-use Test::More tests => 5; >+use Test::More tests => 6; > use Test::Deep; > use Test::MockModule; > use Test::Warn; > use File::Temp qw/tempfile/; >+use URI::Escape; > > use t::lib::Mocks; > >@@ -139,3 +140,26 @@ subtest "Absolute path change in _get_template_file" => sub { > $template->param( quality => 'good-for-nothing' ); > like( $template->output, qr/a good.+template.+doubt/, 'Testing a template with an absolute path' ); > }; >+ >+subtest "Template::Toolkit uses RFC3986" => sub { >+ plan tests => 1; >+ >+ my $s = q{console.log("alert('boo!')");}; >+ my ( $fh, $fn ) = tempfile( SUFFIX => '.tt', UNLINK => 1, DIR => C4::Context::temporary_directory ); >+ print $fh q{URI=[% filter_me | uri %], URL=[% filter_me | url %]}; >+ close $fh; >+ my ( $template, $login, $cookie ) = C4::Auth::get_template_and_user( >+ { >+ template_name => $fn, >+ query => CGI::new, >+ type => "opac", >+ authnotrequired => 1, >+ } >+ ); >+ $template->param( filter_me => $s ); >+ my $filtered_s = uri_escape $s; >+ is( >+ $template->output, sprintf( q{URI=%s, URL=%s}, $filtered_s, $filtered_s ), >+ 'Testing a template with an absolute path' >+ ); >+}; >-- >2.47.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38467
:
174659
|
174660
|
174762
|
174819
|
175465
|
175466
|
175685
|
175686
|
175687
|
175688
|
176135
|
176136
|
176137
|
176138
|
179195