mirror of
https://github.com/dgtlmoon/changedetection.io.git
synced 2025-11-04 00:27:48 +00:00
66 lines
2.0 KiB
Python
66 lines
2.0 KiB
Python
from flask import url_for
|
|
from .util import set_original_response, set_modified_response, live_server_setup, wait_for_all_checks
|
|
import time
|
|
|
|
|
|
def test_bad_access(client, live_server):
|
|
live_server_setup(live_server)
|
|
res = client.post(
|
|
url_for("import_page"),
|
|
data={"urls": 'https://localhost'},
|
|
follow_redirects=True
|
|
)
|
|
|
|
assert b"1 Imported" in res.data
|
|
wait_for_all_checks(client)
|
|
|
|
# Attempt to add a body with a GET method
|
|
res = client.post(
|
|
url_for("edit_page", uuid="first"),
|
|
data={
|
|
"url": 'javascript:alert(document.domain)',
|
|
"tags": "",
|
|
"method": "GET",
|
|
"fetch_backend": "html_requests",
|
|
"body": ""},
|
|
follow_redirects=True
|
|
)
|
|
|
|
assert b'Watch protocol is not permitted by SAFE_PROTOCOL_REGEX' in res.data
|
|
|
|
res = client.post(
|
|
url_for("form_quick_watch_add"),
|
|
data={"url": ' javascript:alert(123)', "tags": ''},
|
|
follow_redirects=True
|
|
)
|
|
|
|
assert b'Watch protocol is not permitted by SAFE_PROTOCOL_REGEX' in res.data
|
|
|
|
res = client.post(
|
|
url_for("form_quick_watch_add"),
|
|
data={"url": '%20%20%20javascript:alert(123)%20%20', "tags": ''},
|
|
follow_redirects=True
|
|
)
|
|
|
|
assert b'Watch protocol is not permitted by SAFE_PROTOCOL_REGEX' in res.data
|
|
|
|
|
|
res = client.post(
|
|
url_for("form_quick_watch_add"),
|
|
data={"url": ' source:javascript:alert(document.domain)', "tags": ''},
|
|
follow_redirects=True
|
|
)
|
|
|
|
assert b'Watch protocol is not permitted by SAFE_PROTOCOL_REGEX' in res.data
|
|
|
|
# file:// is permitted by default, but it will be caught by ALLOW_FILE_URI
|
|
|
|
client.post(
|
|
url_for("form_quick_watch_add"),
|
|
data={"url": 'file:///tasty/disk/drive', "tags": ''},
|
|
follow_redirects=True
|
|
)
|
|
wait_for_all_checks(client)
|
|
res = client.get(url_for("index"))
|
|
|
|
assert b'file:// type access is denied for security reasons.' in res.data |