# -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. from unittest.mock import patch import email.policy import email.message import re import threading from odoo.tests.common import BaseCase, SavepointCase, TransactionCase from odoo.tools import ( is_html_empty, html_sanitize, append_content_to_html, plaintext2html, email_split, misc, formataddr, prepend_html_content, ) from . import test_mail_examples class TestSanitizer(BaseCase): """ Test the html sanitizer that filters html to remove unwanted attributes """ def test_basic_sanitizer(self): cases = [ ("yop", "

yop

"), # simple ("lala

yop

xxx", "

lala

yop

xxx"), # trailing text ("Merci à l'intérêt pour notre produit.nous vous contacterons bientôt. Merci", u"

Merci à l'intérêt pour notre produit.nous vous contacterons bientôt. Merci

"), # unicode ] for content, expected in cases: html = html_sanitize(content) self.assertEqual(html, expected, 'html_sanitize is broken') def test_mako(self): cases = [ ('''

Some text

<% set signup_url = object.get_signup_url() %> % if signup_url:

You can access this document and pay online via our Customer Portal:

''', '''

Some text

<% set signup_url = object.get_signup_url() %> % if signup_url:

You can access this document and pay online via our Customer Portal:

''') ] for content, expected in cases: html = html_sanitize(content, silent=False) self.assertEqual(html, expected, 'html_sanitize: broken mako management') def test_evil_malicious_code(self): # taken from https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Tests cases = [ (""), # no quotes and semicolons (""), # UTF-8 Unicode encoding (""), # hex encoding (""), # embedded carriage return (""), # embedded newline (""), # embedded tab (""), # embedded encoded tab (""), # spaces and meta-characters ("\">"), # malformed tag (""), # non-alpha-non-digits (""), # non-alpha-non-digits ("<"), # extraneous open brackets ("