|
|
|
@ -13,7 +13,7 @@ import ( |
|
|
|
|
"github.com/stretchr/testify/assert" |
|
|
|
|
) |
|
|
|
|
|
|
|
|
|
func testPullCreate(t *testing.T, session *TestSession, user, repo, branch string) *TestResponse { |
|
|
|
|
func testPullCreate(t *testing.T, session *TestSession, user, repo, branch, title string) *TestResponse { |
|
|
|
|
req := NewRequest(t, "GET", path.Join(user, repo)) |
|
|
|
|
resp := session.MakeRequest(t, req, http.StatusOK) |
|
|
|
|
|
|
|
|
@ -34,7 +34,7 @@ func testPullCreate(t *testing.T, session *TestSession, user, repo, branch strin |
|
|
|
|
assert.True(t, exists, "The template has changed") |
|
|
|
|
req = NewRequestWithValues(t, "POST", link, map[string]string{ |
|
|
|
|
"_csrf": htmlDoc.GetCSRF(), |
|
|
|
|
"title": "This is a pull title", |
|
|
|
|
"title": title, |
|
|
|
|
}) |
|
|
|
|
resp = session.MakeRequest(t, req, http.StatusFound) |
|
|
|
|
|
|
|
|
@ -48,5 +48,40 @@ func TestPullCreate(t *testing.T) { |
|
|
|
|
session := loginUser(t, "user1") |
|
|
|
|
testRepoFork(t, session, "user2", "repo1", "user1", "repo1") |
|
|
|
|
testEditFile(t, session, "user1", "repo1", "master", "README.md", "Hello, World (Edited)\n") |
|
|
|
|
testPullCreate(t, session, "user1", "repo1", "master") |
|
|
|
|
testPullCreate(t, session, "user1", "repo1", "master", "This is a pull title") |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
func TestPullCreate_TitleEscape(t *testing.T) { |
|
|
|
|
prepareTestEnv(t) |
|
|
|
|
session := loginUser(t, "user1") |
|
|
|
|
testRepoFork(t, session, "user2", "repo1", "user1", "repo1") |
|
|
|
|
testEditFile(t, session, "user1", "repo1", "master", "README.md", "Hello, World (Edited)\n") |
|
|
|
|
resp := testPullCreate(t, session, "user1", "repo1", "master", "<i>XSS PR</i>") |
|
|
|
|
|
|
|
|
|
// check the redirected URL
|
|
|
|
|
url := RedirectURL(t, resp) |
|
|
|
|
assert.Regexp(t, "^/user2/repo1/pulls/[0-9]*$", url) |
|
|
|
|
|
|
|
|
|
// Edit title
|
|
|
|
|
req := NewRequest(t, "GET", url) |
|
|
|
|
resp = session.MakeRequest(t, req, http.StatusOK) |
|
|
|
|
htmlDoc := NewHTMLParser(t, resp.Body) |
|
|
|
|
editTestTitleURL, exists := htmlDoc.doc.Find("#save-edit-title").First().Attr("data-update-url") |
|
|
|
|
assert.True(t, exists, "The template has changed") |
|
|
|
|
|
|
|
|
|
req = NewRequestWithValues(t, "POST", editTestTitleURL, map[string]string{ |
|
|
|
|
"_csrf": htmlDoc.GetCSRF(), |
|
|
|
|
"title": "<u>XSS PR</u>", |
|
|
|
|
}) |
|
|
|
|
session.MakeRequest(t, req, http.StatusOK) |
|
|
|
|
|
|
|
|
|
req = NewRequest(t, "GET", url) |
|
|
|
|
resp = session.MakeRequest(t, req, http.StatusOK) |
|
|
|
|
htmlDoc = NewHTMLParser(t, resp.Body) |
|
|
|
|
titleHTML, err := htmlDoc.doc.Find(".comments .event .text b").First().Html() |
|
|
|
|
assert.NoError(t, err) |
|
|
|
|
assert.Equal(t, "<i>XSS PR</i>", titleHTML) |
|
|
|
|
titleHTML, err = htmlDoc.doc.Find(".comments .event .text b").Next().Html() |
|
|
|
|
assert.NoError(t, err) |
|
|
|
|
assert.Equal(t, "<u>XSS PR</u>", titleHTML) |
|
|
|
|
} |
|
|
|
|