# -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. from unittest.mock import patch import email.policy import email.message import re import threading from odoo.addons.base.models.ir_mail_server import extract_rfc2822_addresses from odoo.tests.common import BaseCase, TransactionCase from odoo.tools import ( is_html_empty, html_sanitize, append_content_to_html, plaintext2html, email_split, email_domain_normalize, misc, formataddr, prepend_html_content, ) from . import test_mail_examples class TestSanitizer(BaseCase): """ Test the html sanitizer that filters html to remove unwanted attributes """ def test_basic_sanitizer(self): cases = [ ("yop", "

yop

"), # simple ("lala

yop

xxx", "

lala

yop

xxx"), # trailing text ("Merci à l'intérêt pour notre produit.nous vous contacterons bientôt. Merci", u"

Merci à l'intérêt pour notre produit.nous vous contacterons bientôt. Merci

"), # unicode ] for content, expected in cases: html = html_sanitize(content) self.assertEqual(html, expected, 'html_sanitize is broken') def test_evil_malicious_code(self): # taken from https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Tests cases = [ ("

"), # no quotes and semicolons ("

"), # UTF-8 Unicode encoding ("

"), # hex encoding ("

"), # embedded carriage return ("

"), # embedded newline ("

"), # embedded tab ("

"), # embedded encoded tab ("

"), # spaces and meta-characters ("

\">"), # malformed tag (""), # non-alpha-non-digits (""), # non-alpha-non-digits ("<"), # extraneous open brackets ("