mirror of
https://github.com/OCA/knowledge.git
synced 2025-12-22 21:32:18 -06:00
[14.0][FIX] document_page: Stored XSS
unitary tests added post-migration script added
This commit is contained in:
24
document_page/tests/test_document_page_content_sanitized.py
Normal file
24
document_page/tests/test_document_page_content_sanitized.py
Normal file
@@ -0,0 +1,24 @@
|
||||
from odoo.tests import common
|
||||
|
||||
|
||||
class TestDocumentContentSanitized(common.TransactionCase):
|
||||
def setUp(self):
|
||||
super(TestDocumentContentSanitized, self).setUp()
|
||||
self.page_obj = self.env["document.page"]
|
||||
self.category1 = self.env.ref("document_page.demo_category1")
|
||||
|
||||
def test_page_content_sanitized(self):
|
||||
malicious_page = self.page_obj.create(
|
||||
{
|
||||
"name": "Malicious Page",
|
||||
"parent_id": self.category1.id,
|
||||
"content": "<p>Test content</p><script> alert(1)</script>",
|
||||
}
|
||||
)
|
||||
self.assertEqual(malicious_page.content, "<p>Test content</p>")
|
||||
|
||||
malicious_page.write(
|
||||
{"content": "<p>Test content</p><script> alert(1)</script>"}
|
||||
)
|
||||
|
||||
self.assertEqual(malicious_page.content, "<p>Test content</p>")
|
||||
Reference in New Issue
Block a user