1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
from pygitweb.actions import project_board_link
from pygitweb.templates_env import env, html_format, html_join, html_link, trusted_html
def test_table_escapes_plain_text() -> None:
html = env.get_template("table.html").render(
cols=["Name"],
rows=[["<script>alert(1)</script>"]],
)
assert "<script>" not in html
assert "<script>alert(1)</script>" in html
def test_table_renders_link_without_double_escaping() -> None:
cell = html_link("/p?a=commit&h=abc", "a<b", id="commit-link")
html = env.get_template("table.html").render(cols=["Commit"], rows=[[cell]])
assert 'href="/p?a=commit&h=abc"' in html
assert 'id="commit-link"' in html
assert ">a<b</a>" in html
assert "&amp;" not in html
def test_html_join_escapes_text_and_keeps_markup() -> None:
joined = html_join([html_link("/a", "x"), " <", "a&b", ">"])
assert str(joined) == '<a href="/a">x</a> <a&b>'
def test_trusted_html_is_not_escaped_in_table() -> None:
html = env.get_template("table.html").render(
cols=["V"],
rows=[[trusted_html("<em>ok</em>")]],
)
assert "<em>ok</em>" in html
def test_html_format_escapes_values() -> None:
assert str(html_format("<pre>{}</pre>", "<hi>")) == "<pre><hi></pre>"
def test_project_board_link_points_at_existing_board(monkeypatch) -> None:
monkeypatch.setattr(
"pygitweb.actions.git_get_references",
lambda _project, _prefix: [("Tasks", "refs/tags/boards/Tasks")],
)
assert str(project_board_link("demo")) == '<a href="/project/demo/board/">project board</a>'
def test_project_board_link_offers_create_when_missing(monkeypatch) -> None:
monkeypatch.setattr("pygitweb.actions.git_get_references", lambda _project, _prefix: [])
monkeypatch.setattr("pygitweb.actions.settings.AUTH", True)
html = str(project_board_link("my proj"))
assert 'href="/board/create?project=my%20proj"' in html
assert 'style="color: #999; cursor: not-allowed;"' in html
assert ">create board</a>" in html
monkeypatch.setattr("pygitweb.actions.settings.AUTH", False)
plain = str(project_board_link("my proj"))
assert "style=" not in plain
assert ">create board</a>" in plain