Commit 387d4f6a by Adam

Merge pull request #10222 from edx/mashtaq/fix-quality-template-escaping

Fix quality for template escaping
parents a144fdde 1b49f0cd
...@@ -1343,14 +1343,13 @@ class ForumDiscussionXSSTestCase(UrlResetMixin, ModuleStoreTestCase): ...@@ -1343,14 +1343,13 @@ class ForumDiscussionXSSTestCase(UrlResetMixin, ModuleStoreTestCase):
@ddt.data('"><script>alert(1)</script>', '<script>alert(1)</script>', '</script><script>alert(1)</script>') @ddt.data('"><script>alert(1)</script>', '<script>alert(1)</script>', '</script><script>alert(1)</script>')
@patch('student.models.cc.User.from_django_user') @patch('student.models.cc.User.from_django_user')
def test_forum_discussion_xss_prevent(self, malicious_code, mock_from_django_user, mock_request): def test_forum_discussion_xss_prevent(self, malicious_code, mock_user, mock_req): # pylint: disable=unused-argument
""" """
Test that XSS attack is prevented Test that XSS attack is prevented
""" """
reverse_url = "%s%s" % (reverse( reverse_url = "%s%s" % (reverse(
"django_comment_client.forum.views.forum_form_discussion", "django_comment_client.forum.views.forum_form_discussion",
kwargs={"course_id": unicode(self.course.id)}), '/forum_form_discussion' kwargs={"course_id": unicode(self.course.id)}), '/forum_form_discussion')
)
# Test that malicious code does not appear in html # Test that malicious code does not appear in html
url = "%s?%s=%s" % (reverse_url, 'sort_key', malicious_code) url = "%s?%s=%s" % (reverse_url, 'sort_key', malicious_code)
resp = self.client.get(url) resp = self.client.get(url)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment