You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

38 lines
1.1 KiB

  1. // Copyright 2017 The Gitea Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package integrations
  5. import (
  6. "net/http"
  7. "testing"
  8. "code.gitea.io/gitea/models"
  9. "github.com/stretchr/testify/assert"
  10. )
  11. func TestXSSUserFullName(t *testing.T) {
  12. defer prepareTestEnv(t)()
  13. user := models.AssertExistsAndLoadBean(t, &models.User{ID: 2}).(*models.User)
  14. const fullName = `name & <script class="evil">alert('Oh no!');</script>`
  15. session := loginUser(t, user.Name)
  16. req := NewRequestWithValues(t, "POST", "/user/settings", map[string]string{
  17. "_csrf": GetCSRF(t, session, "/user/settings"),
  18. "name": user.Name,
  19. "full_name": fullName,
  20. "email": user.Email,
  21. "language": "en-us",
  22. })
  23. session.MakeRequest(t, req, http.StatusFound)
  24. req = NewRequestf(t, "GET", "/%s", user.Name)
  25. resp := session.MakeRequest(t, req, http.StatusOK)
  26. htmlDoc := NewHTMLParser(t, resp.Body)
  27. assert.EqualValues(t, 0, htmlDoc.doc.Find("script.evil").Length())
  28. assert.EqualValues(t, fullName,
  29. htmlDoc.doc.Find("div.content").Find(".header.text.center").Text(),
  30. )
  31. }