# -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. from unittest.mock import patch import email.policy import email.message import re import threading from odoo.tests.common import BaseCase, SavepointCase, TransactionCase from odoo.tools import ( is_html_empty, html_sanitize, append_content_to_html, plaintext2html, email_split, misc, formataddr, prepend_html_content, ) from . import test_mail_examples class TestSanitizer(BaseCase): """ Test the html sanitizer that filters html to remove unwanted attributes """ def test_basic_sanitizer(self): cases = [ ("yop", "
yop
"), # simple ("lalayop
xxx", "lala
yop
xxx"), # trailing text ("Merci à l'intérêt pour notre produit.nous vous contacterons bientôt. Merci", u"Merci à l'intérêt pour notre produit.nous vous contacterons bientôt. Merci
"), # unicode ] for content, expected in cases: html = html_sanitize(content) self.assertEqual(html, expected, 'html_sanitize is broken') def test_mako(self): cases = [ ('''Some text
<% set signup_url = object.get_signup_url() %> % if signup_url:You can access this document and pay online via our Customer Portal:
''', '''Some text
<% set signup_url = object.get_signup_url() %> % if signup_url:You can access this document and pay online via our Customer Portal:
''') ] for content, expected in cases: html = html_sanitize(content, silent=False) self.assertEqual(html, expected, 'html_sanitize: broken mako management') def test_evil_malicious_code(self): # taken from https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Tests cases = [ ("