U
|®Þhw ã @ sh d dl mZ d dlmZ d dlmZmZmZmZ G dd„ deƒZ G dd„ deeƒZ
G dd „ d eeƒZ d
S ) é )ÚTestCase)ÚWagtailTestUtils)Ú WhitelisterÚallow_without_attributesÚattribute_ruleÚ check_urlc @ s$ e Zd Zdd„ Zdd„ Zdd„ ZdS )Ú TestCheckUrlc C s( dD ] }|d }| tt|ƒƒ¡ qd S )N)Ú ÚhttpÚhttpsÚftpÚmailtoÚtelz://www.example.com)Z
assertTrueÚboolr )ÚselfÚ
url_schemeÚurl© r úd/var/www/dating/data/www/fatepal.com/env/lib/python3.8/site-packages/wagtail/tests/test_whitelist.pyÚtest_allowed_url_schemes
s z%TestCheckUrl.test_allowed_url_schemesc C s | ttdƒƒ¡ d S )Nz
invalid://url©Z assertFalser r ©r r r r Útest_disallowed_url_scheme s z'TestCheckUrl.test_disallowed_url_schemec C s | ttdƒƒ¡ dS )z
Some URL parsers do not parse 'jav ascript:' as a valid scheme.
Browsers, however, do. The checker needs to catch these crafty schemes
zjav ascript:alert('XSS')Nr r r r r Ú!test_crafty_disallowed_url_scheme s z.TestCheckUrl.test_crafty_disallowed_url_schemeN)Ú__name__Ú
__module__Ú __qualname__r r r r r r r r s r c @ sD e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd d
„ Zd d „ Zd
d„ Z dS )ÚTestAttributeRulec C s | d¡| _d S )Núbaz)Úget_soupÚsoupr r r r ÚsetUp s zTestAttributeRule.setUpc C s0 | j j}tddiƒ}||ƒ | t|ƒd¡ dS )zi
Test that attribute_rule() drops attributes for
which no rule has been defined.
ÚsnowmanZbarbecueú
bazN©r Úbr Ú assertEqualÚstr©r ÚtagÚfnr r r Útest_no_rule_for_attr! s z'TestAttributeRule.test_no_rule_for_attrc C s0 | j j}tddiƒ}||ƒ | t|ƒd¡ dS )zx
Test that attribute_rule() does not change attributes
when the corresponding rule returns True
ÚfooTr Nr$ r( r r r Útest_rule_true_for_attr+ s z)TestAttributeRule.test_rule_true_for_attrc C s0 | j j}tddiƒ}||ƒ | t|ƒd¡ dS )zo
Test that attribute_rule() drops attributes
when the corresponding rule returns False
r, Fr# Nr$ r( r r r Útest_rule_false_for_attr5 s z*TestAttributeRule.test_rule_false_for_attrc C s0 | j j}tdtiƒ}||ƒ | t|ƒd¡ dS )ú¯
Test that when the rule returns a callable,
attribute_rule() replaces the attribute with
the result of calling the callable on the attribute.
r, zbazN)r r% r Úlenr& r' r( r r r Ú test_callable_called_on_attr? s z.TestAttributeRule.test_callable_called_on_attrc C s4 | j j}tddd„ iƒ}||ƒ | t|ƒd¡ dS )r/ r, c S s d S ©Nr )Úxr r r ÚQ ó z>TestAttributeRule.test_callable_returns_None..r# Nr$ r( r r r Útest_callable_returns_NoneJ s z,TestAttributeRule.test_callable_returns_Nonec C s, | d¡}|j}t|ƒ | t|ƒd¡ dS )zS
Test that attribute_rule() with will drop all
attributes.
z/zN)r r% r r& r' ©r r r) r r r Ú test_allow_without_attributesU s ÿz/TestAttributeRule.test_allow_without_attributesN)
r r r r! r+ r- r. r1 r6 r8 r r r r r s
r c @ sT e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd d
„ Zd d „ Zd
d„ Z dd„ Z
dd„ Z dS )ÚTestWhitelisterc C s t ƒ | _d S r2 )r Ú whitelisterr r r r r! c s zTestWhitelister.setUpc C s4 | d¡}|j}| j d|j¡ | t|ƒd¡ dS )zL
Unknown node should remove a node from the parent document
z bazquuxr zquuxN)r r, r: Zclean_unknown_nodeÚbarr& r' r7 r r r Útest_clean_unknown_nodef s
z'TestWhitelister.test_clean_unknown_nodec C s2 | d¡}|j}| j ||¡ | t|ƒd¡ dS )zj
tags are allowed without attributes. This remains true
when tags are nested.
z#foozfooN©r r% r: Zclean_tag_noder& r' r7 r r r Ú1test_clean_tag_node_cleans_nested_recognised_nodeo s
zATestWhitelister.test_clean_tag_node_cleans_nested_recognised_nodec C s2 | d¡}|j}| j ||¡ | t|ƒd¡ dS )zA
tags should be removed, even when nested.
zbarú
barNr= r7 r r r Ú6test_clean_tag_node_disallows_nested_unrecognised_nodey s
zFTestWhitelister.test_clean_tag_node_disallows_nested_unrecognised_nodec C s4 | d¡}|jj}| j ||¡ | t|ƒd¡ d S ©Nr? r; )r r% Ústringr: Zclean_string_noder& r' ©r r rB r r r Ú#test_clean_string_node_does_nothing‚ s
z3TestWhitelister.test_clean_string_node_does_nothingc C s4 | d¡}|jj}| j ||¡ | t|ƒd¡ d S rA )r r% rB r: Z
clean_noder& r' rC r r r Ú1test_clean_node_does_not_change_navigable_stringsˆ s
zATestWhitelister.test_clean_node_does_not_change_navigable_stringsc C s d}| j |¡}| |d¡ dS )zf
Whitelister.clean should remove disallowed tags and attributes from
a string
z7snowman Yorkshireúsnowman YorkshireN©r: Úcleanr& ©r rB Zcleaned_stringr r r Ú
test_cleanŽ s zTestWhitelister.test_cleanc C s d}| j |¡}| |d¡ d S )NzDsnowman YorkshirerF rG rI r r r Útest_clean_comments— s z#TestWhitelister.test_clean_commentsc C s d}| j |¡}| |d¡ d S )Nz:![Arthur "two sheds" Jackson]()
z1![Arthur "two sheds" Jackson]()
rG rI r r r Ú test_quotingœ s ÿz TestWhitelister.test_quotingN) r r r r! r< r> r@ rD rE rJ rK rL r r r r r9 b s
r9 N) Z django.testr Zwagtail.test.utilsr Zwagtail.whitelistr r r r r r r9 r r r r Ú s
E