Bugzilla – Attachment 89009 Details for
Bug 22478
Cross-site scripting vulnerability in paginations
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 22478: (QA follow-up) Update tests to check for any script tags
Bug-22478-QA-follow-up-Update-tests-to-check-for-a.patch (text/plain), 1.78 KB, created by
Martin Renvoize (ashimema)
on 2019-04-29 12:33:10 UTC
(
hide
)
Description:
Bug 22478: (QA follow-up) Update tests to check for any script tags
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2019-04-29 12:33:10 UTC
Size:
1.78 KB
patch
obsolete
>From 01dc3a2a8b079b80a5aeb09b6a4c14ca667226a2 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Mon, 29 Apr 2019 13:30:09 +0100 >Subject: [PATCH] Bug 22478: (QA follow-up) Update tests to check for any > script tags > >--- > t/db_dependent/selenium/regressions.t | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > >diff --git a/t/db_dependent/selenium/regressions.t b/t/db_dependent/selenium/regressions.t >index f2b9e1fb70..42a6b6607d 100644 >--- a/t/db_dependent/selenium/regressions.t >+++ b/t/db_dependent/selenium/regressions.t >@@ -185,7 +185,7 @@ subtest 'Display circulation table correctly' => sub { > }; > > subtest 'XSS vulnerabilities in pagination' => sub { >- plan tests => 3; >+ plan tests => 4; > > my $patron = $builder->build_object({ class => 'Koha::Patrons' }); > for ( 1 .. 30 ) { # We want the pagination to be displayed >@@ -225,7 +225,8 @@ subtest 'XSS vulnerabilities in pagination' => sub { > is( $alert_text, undef, 'No alert box displayed, even if evil intent' ); > > my $second_page = $driver->find_element('//div[@class="pages"]/span[@class="currentPage"]/following-sibling::a'); >- like( $second_page->get_attribute('href'), qr{category=1%22%3E%3Cscript%3Ealert%28%27booh%21%27%29%3C%2Fscript%3E}, 'The second patch should displayed the variables and attributes correctly URI escaped' ); >+ unlike( $second_page->get_attribute('href'), qr{%22%3E%3Cscript%3Ealert%28%27booh%21%27%29%3C%2Fscript%3E}, 'The second page link should not contain any script tags (escaped or otherwise)' ); >+ unlike( $second_page->get_attribute('href'), qr{"<script>alert('booh!')</script>}, 'The second page link should not contain any script tags (escaped or otherwise)' ); > > push @cleanup, $patron, $patron->category, $patron->library; > }; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 22478
:
86636
|
86683
|
87697
|
87698
|
87699
|
87700
|
87701
|
87841
|
87842
|
87843
|
87844
|
88937
|
88954
|
89002
|
89003
|
89004
|
89005
|
89006
| 89009 |
89453