summaryrefslogtreecommitdiff
path: root/tests
diff options
context:
space:
mode:
authorJon Dufresne <jon.dufresne@gmail.com>2020-05-26 09:51:02 +0200
committerCarlton Gibson <carlton.gibson@noumenal.es>2020-06-03 09:32:35 +0200
commit1f2dd37f6fcefdd10ed44cb233b2e62b520afb38 (patch)
tree5bfe03d368a683e3b08504de32a14d3d309f7f8b /tests
parent256d29710193f7a2f1e92abe96c94d036f73edc6 (diff)
downloaddjango-1f2dd37f6fcefdd10ed44cb233b2e62b520afb38.tar.gz
[3.0.x] Fixed CVE-2020-13596 -- Fixed potential XSS in admin ForeignKeyRawIdWidget.
Diffstat (limited to 'tests')
-rw-r--r--tests/admin_widgets/models.py8
-rw-r--r--tests/admin_widgets/tests.py11
2 files changed, 19 insertions, 0 deletions
diff --git a/tests/admin_widgets/models.py b/tests/admin_widgets/models.py
index b5025fdfd7..88bf2b8fca 100644
--- a/tests/admin_widgets/models.py
+++ b/tests/admin_widgets/models.py
@@ -27,6 +27,14 @@ class Band(models.Model):
return self.name
+class UnsafeLimitChoicesTo(models.Model):
+ band = models.ForeignKey(
+ Band,
+ models.CASCADE,
+ limit_choices_to={'name': '"&><escapeme'},
+ )
+
+
class Album(models.Model):
band = models.ForeignKey(Band, models.CASCADE)
featuring = models.ManyToManyField(Band, related_name='featured')
diff --git a/tests/admin_widgets/tests.py b/tests/admin_widgets/tests.py
index 7aa597a87d..7d3d71181e 100644
--- a/tests/admin_widgets/tests.py
+++ b/tests/admin_widgets/tests.py
@@ -22,6 +22,7 @@ from django.utils import translation
from .models import (
Advisor, Album, Band, Bee, Car, Company, Event, Honeycomb, Individual,
Inventory, Member, MyFileField, Profile, School, Student,
+ UnsafeLimitChoicesTo,
)
from .widgetadmin import site as widget_admin_site
@@ -586,6 +587,16 @@ class ForeignKeyRawIdWidgetTest(TestCase):
'Hidden</a></strong>' % {'pk': hidden.pk}
)
+ def test_render_unsafe_limit_choices_to(self):
+ rel = UnsafeLimitChoicesTo._meta.get_field('band').remote_field
+ w = widgets.ForeignKeyRawIdWidget(rel, widget_admin_site)
+ self.assertHTMLEqual(
+ w.render('test', None),
+ '<input type="text" name="test" class="vForeignKeyRawIdAdminField">\n'
+ '<a href="/admin_widgets/band/?name=%22%26%3E%3Cescapeme&amp;_to_field=id" '
+ 'class="related-lookup" id="lookup_id_test" title="Lookup"></a>'
+ )
+
@override_settings(ROOT_URLCONF='admin_widgets.urls')
class ManyToManyRawIdWidgetTest(TestCase):