marcel/linkding
1
0
Fork 0
mirror of https://github.com/sissbruecker/linkding.git synced 2025-12-05 03:55:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

Properly encode search query param (#587)

Browse Source
This commit is contained in:
Sascha Ißbrücker
2023-12-08 21:53:54 +01:00
committed by GitHub
parent 227cfdb063
commit 6355d8dff1
4 changed files with 89 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
bookmarks/tests/test_bookmark_index_view.py
View File

@@ -418,3 +418,31 @@ class BookmarkIndexViewTestCase(TestCase, BookmarkFactoryMixin, HtmlTestMixin):
self.assertEqual(actions_form.attrs['action'],
'/bookmarks/action?q=%23foo&return_url=%2Fbookmarks%3Fq%3D%2523foo')
def test_encode_search_params(self):
bookmark = self.setup_bookmark(description='alert(\'xss\')')
url = reverse('bookmarks:index') + '?q=alert(%27xss%27)'
response = self.client.get(url)
self.assertNotContains(response, 'alert(\'xss\')')
self.assertContains(response, bookmark.url)
url = reverse('bookmarks:index') + '?sort=alert(%27xss%27)'
response = self.client.get(url)
self.assertNotContains(response, 'alert(\'xss\')')
url = reverse('bookmarks:index') + '?unread=alert(%27xss%27)'
response = self.client.get(url)
self.assertNotContains(response, 'alert(\'xss\')')
url = reverse('bookmarks:index') + '?shared=alert(%27xss%27)'
response = self.client.get(url)
self.assertNotContains(response, 'alert(\'xss\')')
url = reverse('bookmarks:index') + '?user=alert(%27xss%27)'
response = self.client.get(url)
self.assertNotContains(response, 'alert(\'xss\')')
url = reverse('bookmarks:index') + '?page=alert(%27xss%27)'
response = self.client.get(url)
self.assertNotContains(response, 'alert(\'xss\')')