Commit eb8459d5 authored by Tres Seaver's avatar Tres Seaver

Drop 'assertNotIn' for the sake of Python 2.6.

parent eeeaeb72
......@@ -336,7 +336,8 @@ class ImageTests(FileTests):
('<img src="http://foo/file" alt="" title="" height="16" width="16" />'))
def testTag(self):
tag_fmt = '<img src="http://foo/file" alt="%s" title="%s" height="16" width="16" />'
tag_fmt = ('<img src="http://foo/file" alt="%s" title="%s" '
'height="16" width="16" />')
self.assertEqual(self.file.tag(), (tag_fmt % ('','')))
self.file.manage_changeProperties(title='foo')
self.assertEqual(self.file.tag(), (tag_fmt % ('','foo')))
......@@ -357,8 +358,13 @@ class ImageTests(FileTests):
class ImagePublishTests(Testing.ZopeTestCase.FunctionalTestCase):
def testTagSafe(self):
self.app.manage_addImage("image", "")
res = self.publish("/image/tag?height=0&width=0&css_class=%22%3E%3Cscript%20type%3D%22text%2Fjavascript%22%3Ealert('evil')%3B%3C%2Fscript%3E%3Cdiv%20class%3D%22")
self.assertNotIn('<script type="text/javascript">alert(\'evil\');</script>', res.getBody())
res = self.publish(
"/image/tag?height=0&width=0&css_class=%22%3E%3Cscript%20type"
"%3D%22text%2Fjavascript%22%3Ealert('evil')%3B%3C%2Fscript"
"%3E%3Cdiv%20class%3D%22")
self.assertFalse(
'<script type="text/javascript">alert(\'evil\');</script>'
in res.getBody())
def test_suite():
......
......@@ -652,7 +652,7 @@ class TestBrowserIdManagerPublish(Testing.ZopeTestCase.FunctionalTestCase):
res = self.publish(
'/browser_id_manager/encodeUrl?url=%3Chtml%3EEVIL%2Fhtml%3E%3C!--')
self.assertNotIn("<html>EVIL/html>", res.getBody())
self.assertFalse("<html>EVIL/html>" in res.getBody())
class DummyObject:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment