[14.0][FIX] document_page: Stored XSS

unitary tests added

post-migration script added
This commit is contained in:
SergiCForgeFlow
2023-08-10 12:55:29 +02:00
parent d1b2e58312
commit eda3c2a1cb
9 changed files with 52 additions and 15 deletions

View File

@@ -0,0 +1,24 @@
from odoo.tests import common
class TestDocumentContentSanitized(common.TransactionCase):
def setUp(self):
super(TestDocumentContentSanitized, self).setUp()
self.page_obj = self.env["document.page"]
self.category1 = self.env.ref("document_page.demo_category1")
def test_page_content_sanitized(self):
malicious_page = self.page_obj.create(
{
"name": "Malicious Page",
"parent_id": self.category1.id,
"content": "<p>Test content</p><script> alert(1)</script>",
}
)
self.assertEqual(malicious_page.content, "<p>Test content</p>")
malicious_page.write(
{"content": "<p>Test content</p><script> alert(1)</script>"}
)
self.assertEqual(malicious_page.content, "<p>Test content</p>")