← Back to branch summary

~loggerhead-team/loggerhead/trunk-rich

« back to all changes in this revision

Viewing changes to loggerhead/tests/test_controllers.py

  • Committer: William Grant
  • Date: 2011-03-24 23:02:29 UTC
  • mfrom: (441.1.7 xss-fix)
  • Revision ID: william.grant@canonical.com-20110324230229-zq85fy6aqvlyylbu
Improve escaping of filenames in revision views. Fixes a couple of XSS holes.

Show diffs side-by-side

added added

removed removed

Lines of Context:
loggerhead/tests/test_controllers.py
1
1
from cStringIO import StringIO
2
2
import logging
3
 
import simplejson
4
3
 
5
4
from paste.httpexceptions import HTTPServerError
6
5
 
10
9
from loggerhead.controllers.annotate_ui import AnnotateUI
11
10
from loggerhead.controllers.inventory_ui import InventoryUI
12
11
from loggerhead.controllers.revision_ui import RevisionUI
13
 
from loggerhead.controllers.revlog_ui import RevLogUI
14
12
from loggerhead.tests.test_simple import BasicTests
15
13
from loggerhead import util
16
14
 
17
15
 
18
 
def consume_app(app, env):
19
 
    body = StringIO()
20
 
    start = []
21
 
    def start_response(status, headers, exc_info=None):
22
 
        start.append((status, headers, exc_info))
23
 
        return body.write
24
 
    extra_content = list(app(env, start_response))
25
 
    body.writelines(extra_content)
26
 
    return start[0], body.getvalue()
27
 
 
28
 
 
29
16
class TestInventoryUI(BasicTests):
30
17
 
31
18
    def make_bzrbranch_and_inventory_ui_for_tree_shape(self, shape):
43
30
        branch_app._url_base = '/'
44
31
        return tree.branch, InventoryUI(branch_app, branch_app.get_history)
45
32
 
 
33
    def consume_app(self, app, extra_environ=None):
 
34
        env = {'SCRIPT_NAME': '/files', 'PATH_INFO': ''}
 
35
        if extra_environ is not None:
 
36
            env.update(extra_environ)
 
37
        body = StringIO()
 
38
        start = []
 
39
        def start_response(status, headers, exc_info=None):
 
40
            start.append((status, headers, exc_info))
 
41
            return body.write
 
42
        extra_content = list(app(env, start_response))
 
43
        body.writelines(extra_content)
 
44
        return start[0], body.getvalue()
 
45
 
46
46
    def test_get_filelist(self):
47
47
        bzrbranch, inv_ui = self.make_bzrbranch_and_inventory_ui_for_tree_shape(
48
48
            ['filename'])
52
52
    def test_smoke(self):
53
53
        bzrbranch, inv_ui = self.make_bzrbranch_and_inventory_ui_for_tree_shape(
54
54
            ['filename'])
55
 
        start, content = consume_app(inv_ui,
56
 
            {'SCRIPT_NAME': '/files', 'PATH_INFO': ''})
 
55
        start, content = self.consume_app(inv_ui)
57
56
        self.assertEqual(('200 OK', [('Content-Type', 'text/html')], None),
58
57
                         start)
59
58
        self.assertContainsRe(content, 'filename')
61
60
    def test_no_content_for_HEAD(self):
62
61
        bzrbranch, inv_ui = self.make_bzrbranch_and_inventory_ui_for_tree_shape(
63
62
            ['filename'])
64
 
        start, content = consume_app(inv_ui,
65
 
            {'SCRIPT_NAME': '/files', 'PATH_INFO': '',
66
 
             'REQUEST_METHOD': 'HEAD'})
 
63
        start, content = self.consume_app(inv_ui,
 
64
                            extra_environ={'REQUEST_METHOD': 'HEAD'})
67
65
        self.assertEqual(('200 OK', [('Content-Type', 'text/html')], None),
68
66
                         start)
69
67
        self.assertEqual('', content)
81
79
        tree.commit('')
82
80
        tree.branch.lock_read()
83
81
        self.addCleanup(tree.branch.unlock)
84
 
        branch_app = self.make_branch_app(tree.branch)
 
82
        branch_app = BranchWSGIApp(tree.branch)
 
83
        branch_app._environ = {
 
84
            'wsgi.url_scheme':'',
 
85
            'SERVER_NAME':'',
 
86
            'SERVER_PORT':'80',
 
87
            }
 
88
        branch_app._url_base = ''
 
89
        branch_app.friendly_name = ''
85
90
        return tree.branch, RevisionUI(branch_app, branch_app.get_history)
86
91
 
87
92
    def test_get_values(self):
116
121
        ann_ui.args = ['rev2']
117
122
        annotate_info = ann_ui.get_values('filename',
118
123
            kwargs={'file_id': 'file_id'}, headers={})
119
 
        annotated = annotate_info['annotated']
 
124
        annotated = list(annotate_info['annotated'])
120
125
        self.assertEqual(2, len(annotated))
121
 
        self.assertEqual('2', annotated[1].change.revno)
122
 
        self.assertEqual('1', annotated[2].change.revno)
123
 
 
124
 
 
125
 
class TestRevLogUI(BasicTests):
126
 
 
127
 
    def make_branch_app_for_revlog_ui(self):
128
 
        builder = self.make_branch_builder('branch')
129
 
        builder.start_series()
130
 
        builder.build_snapshot('rev-id', None, [
131
 
            ('add', ('', 'root-id', 'directory', '')),
132
 
            ('add', ('filename', 'f-id', 'file', 'content\n'))],
133
 
            message="First commit.")
134
 
        builder.finish_series()
135
 
        branch = builder.get_branch()
136
 
        self.addCleanup(branch.lock_read().unlock)
137
 
        return self.make_branch_app(branch)
138
 
 
139
 
    def test_get_values_smoke(self):
140
 
        branch_app = self.make_branch_app_for_revlog_ui()
141
 
        env = {'SCRIPT_NAME': '/',
142
 
               'PATH_INFO': '/+revlog/rev-id'}
143
 
        revlog_ui = branch_app.lookup_app(env)
144
 
        revlog_ui.parse_args(env)
145
 
        values = revlog_ui.get_values('', {}, {})
146
 
        self.assertEqual(values['file_changes'].added[1].filename, 'filename')
147
 
        self.assertEqual(values['entry'].comment, "First commit.")
148
 
 
149
 
 
150
 
    def test_json_render_smoke(self):
151
 
        branch_app = self.make_branch_app_for_revlog_ui()
152
 
        env = {'SCRIPT_NAME': '', 'PATH_INFO': '/+json/+revlog/rev-id'}
153
 
        revlog_ui = branch_app.lookup_app(env)
154
 
        start, content = consume_app(revlog_ui, env)
155
 
        self.assertEqual('200 OK', start[0])
156
 
        self.assertEqual('application/json', dict(start[1])['Content-Type'])
157
 
        self.assertEqual(None, start[2])
158
 
        simplejson.loads(content)
159
 
 
 
126
        self.assertEqual('2', annotated[0].change.revno)
 
127
        self.assertEqual('1', annotated[1].change.revno)