diff options
author | Markus Holtermann <info@markusholtermann.eu> | 2022-01-02 00:37:40 +0100 |
---|---|---|
committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2022-02-01 07:40:51 +0100 |
commit | 394517f07886495efcf79f95c7ee402a9437bd68 (patch) | |
tree | c7df4b0d112de18ab6caab569e1bde5f7915c218 /tests/template_tests | |
parent | 97a72744681d0993b50dee952cf32cdf9650ad9f (diff) | |
download | django-394517f07886495efcf79f95c7ee402a9437bd68.tar.gz |
Fixed CVE-2022-22818 -- Fixed possible XSS via {% debug %} template tag.
Thanks Keryn Knight for the report.
Co-authored-by: Adam Johnson <me@adamj.eu>
Diffstat (limited to 'tests/template_tests')
-rw-r--r-- | tests/template_tests/syntax_tests/test_debug.py | 46 | ||||
-rw-r--r-- | tests/template_tests/tests.py | 10 |
2 files changed, 46 insertions, 10 deletions
diff --git a/tests/template_tests/syntax_tests/test_debug.py b/tests/template_tests/syntax_tests/test_debug.py new file mode 100644 index 0000000000..2f527b44ae --- /dev/null +++ b/tests/template_tests/syntax_tests/test_debug.py @@ -0,0 +1,46 @@ +from django.contrib.auth.models import Group +from django.test import SimpleTestCase, override_settings + +from ..utils import setup + + +@override_settings(DEBUG=True) +class DebugTests(SimpleTestCase): + + @override_settings(DEBUG=False) + @setup({'non_debug': '{% debug %}'}) + def test_non_debug(self): + output = self.engine.render_to_string('non_debug', {}) + self.assertEqual(output, '') + + @setup({'modules': '{% debug %}'}) + def test_modules(self): + output = self.engine.render_to_string('modules', {}) + self.assertIn( + ''django': <module 'django' ', + output, + ) + + @setup({'plain': '{% debug %}'}) + def test_plain(self): + output = self.engine.render_to_string('plain', {'a': 1}) + self.assertTrue(output.startswith( + '{'a': 1}' + '{'False': False, 'None': None, ' + ''True': True}\n\n{' + )) + + @setup({'non_ascii': '{% debug %}'}) + def test_non_ascii(self): + group = Group(name="清風") + output = self.engine.render_to_string('non_ascii', {'group': group}) + self.assertTrue(output.startswith( + '{'group': <Group: 清風>}' + )) + + @setup({'script': '{% debug %}'}) + def test_script(self): + output = self.engine.render_to_string('script', {'frag': '<script>'}) + self.assertTrue(output.startswith( + '{'frag': '<script>'}' + )) diff --git a/tests/template_tests/tests.py b/tests/template_tests/tests.py index 8cc86bd44f..33837114c6 100644 --- a/tests/template_tests/tests.py +++ b/tests/template_tests/tests.py @@ -1,6 +1,5 @@ import sys -from django.contrib.auth.models import Group from django.template import ( Context, Engine, TemplateDoesNotExist, TemplateSyntaxError, ) @@ -163,15 +162,6 @@ class TemplateTestMixin: with self.assertRaises(NoReverseMatch): t.render(Context()) - def test_debug_tag_non_ascii(self): - """ - #23060 -- Test non-ASCII model representation in debug output. - """ - group = Group(name="清風") - c1 = Context({"objs": [group]}) - t1 = self._engine().from_string('{% debug %}') - self.assertIn("清風", t1.render(c1)) - def test_extends_generic_template(self): """ #24338 -- Allow extending django.template.backends.django.Template |