Commit 1b49f0cd by Mushtaq Ali

Fix quality for template escaping

parent a144fdde
...@@ -1343,14 +1343,13 @@ class ForumDiscussionXSSTestCase(UrlResetMixin, ModuleStoreTestCase): ...@@ -1343,14 +1343,13 @@ class ForumDiscussionXSSTestCase(UrlResetMixin, ModuleStoreTestCase):
@ddt.data('"><script>alert(1)</script>', '<script>alert(1)</script>', '</script><script>alert(1)</script>') @ddt.data('"><script>alert(1)</script>', '<script>alert(1)</script>', '</script><script>alert(1)</script>')
@patch('student.models.cc.User.from_django_user') @patch('student.models.cc.User.from_django_user')
def test_forum_discussion_xss_prevent(self, malicious_code, mock_from_django_user, mock_request): def test_forum_discussion_xss_prevent(self, malicious_code, mock_user, mock_req): # pylint: disable=unused-argument
""" """
Test that XSS attack is prevented Test that XSS attack is prevented
""" """
reverse_url = "%s%s" % (reverse( reverse_url = "%s%s" % (reverse(
"django_comment_client.forum.views.forum_form_discussion", "django_comment_client.forum.views.forum_form_discussion",
kwargs={"course_id": unicode(self.course.id)}), '/forum_form_discussion' kwargs={"course_id": unicode(self.course.id)}), '/forum_form_discussion')
)
# Test that malicious code does not appear in html # Test that malicious code does not appear in html
url = "%s?%s=%s" % (reverse_url, 'sort_key', malicious_code) url = "%s?%s=%s" % (reverse_url, 'sort_key', malicious_code)
resp = self.client.get(url) resp = self.client.get(url)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment