From 00b31cabd5fbeba0cd81075389102cc0985d8ee6 Mon Sep 17 00:00:00 2001 From: dgtlmoon Date: Tue, 28 Oct 2025 10:58:44 +0100 Subject: [PATCH] Fix test --- changedetectionio/tests/test_jinja2.py | 16 ++++------------ changedetectionio/validate_url.py | 1 - 2 files changed, 4 insertions(+), 13 deletions(-) diff --git a/changedetectionio/tests/test_jinja2.py b/changedetectionio/tests/test_jinja2.py index 63692c77..e2992471 100644 --- a/changedetectionio/tests/test_jinja2.py +++ b/changedetectionio/tests/test_jinja2.py @@ -64,29 +64,21 @@ def test_jinja2_time_offset_in_url_query(client, live_server, measure_memory_usa # Should not have template error assert b'Invalid template' not in res.data + # https://techtonics.medium.com/secure-templating-with-jinja2-understanding-ssti-and-jinja2-sandbox-environment-b956edd60456 def test_jinja2_security_url_query(client, live_server, measure_memory_usage): - - # Add our URL to the import page test_url = url_for('test_return_query', _external=True) - # because url_for() will URL-encode the var, but we dont here - full_url = "{}?{}".format(test_url, - "date={{ ''.__class__.__mro__[1].__subclasses__()}}", ) + full_url = test_url + "?date={{ ''.__class__.__mro__[1].__subclasses__()}}" + res = client.post( url_for("ui.ui_views.form_quick_watch_add"), data={"url": full_url, "tags": "test"}, follow_redirects=True ) - assert b"Watch added" in res.data - wait_for_all_checks(client) + assert b"Watch added" not in res.data - # It should report nothing found (no new 'has-unread-changes' class) - res = client.get(url_for("watchlist.index")) - assert b'is invalid and cannot be used' in res.data - # Some of the spewed output from the subclasses - assert b'dict_values' not in res.data def test_timezone(mocker): """Verify that timezone is parsed.""" diff --git a/changedetectionio/validate_url.py b/changedetectionio/validate_url.py index f27b8d7e..9cdbe4bf 100644 --- a/changedetectionio/validate_url.py +++ b/changedetectionio/validate_url.py @@ -60,7 +60,6 @@ def normalize_url_encoding(url): def is_safe_valid_url(test_url): from changedetectionio import strtobool from changedetectionio.jinja2_custom import render as jinja_render - from urllib.parse import urlparse, parse_qs import os import re import validators