RomanNum3ral
/
netbox
mirror of https://github.com/netbox-community/netbox.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Assert the full help text rather than a fragment of it 

The sanitization tests used `assertInHTML`, which checks containment. Each
needle happened to span the whole output, so they passed, but a payload
surviving outside the `rendered-markdown` div would not have failed them.
`assertHTMLEqual` is what the docstring already claimed these tests did.
This commit is contained in:
Jason Novinger 2026-09-14 12:24:02 -05:00
parent 8e68d91124
commit f96e6f86b9
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
netbox/utilities/tests/test_jsonschema.py
View File

@ -53,9 +53,9 @@ class JSONSchemaPropertyDescriptionSanitizationTestCase(TestCase):
applies the HTML_ALLOWED_TAGS allowlist, matching the custom field path in
extras.models.customfields.CustomField.to_form_field().
Each test asserts the complete help text, so a payload that survived anywhere in it would fail
the comparison. Asserting only on the absence of a substring would not, because escaping and
stripping both leave a payload's text behind as character data.
Each test compares the entire help text, so a payload surviving anywhere in it fails the
assertion. Asserting only on the absence of a substring would not, because stripping an
element leaves its text behind as character data.
"""
def test_disallowed_element_is_stripped(self):
@ -67,7 +67,7 @@ class JSONSchemaPropertyDescriptionSanitizationTestCase(TestCase):
field = prop.to_form_field('capacity')
self.assertInHTML(
self.assertHTMLEqual(
'<div class="rendered-markdown"><p>Gross disk size</p></div>',
field.help_text,
)
@ -80,7 +80,7 @@ class JSONSchemaPropertyDescriptionSanitizationTestCase(TestCase):
field = prop.to_form_field('vendor_code')
self.assertInHTML(
self.assertHTMLEqual(
'<div class="rendered-markdown"><p>Vendor code</p></div>',
field.help_text,
)
@ -94,7 +94,7 @@ class JSONSchemaPropertyDescriptionSanitizationTestCase(TestCase):
field = prop.to_form_field('vendor_code')
self.assertInHTML(
self.assertHTMLEqual(
'<div class="rendered-markdown"><p><b>Vendor code</b></p></div>',
field.help_text,
)
@ -107,7 +107,7 @@ class JSONSchemaPropertyDescriptionSanitizationTestCase(TestCase):
field = prop.to_form_field('vendor_code')
self.assertInHTML(
self.assertHTMLEqual(
'<div class="rendered-markdown">'
'<p><a rel="noopener noreferrer">Vendor code</a></p></div>',
field.help_text,
@ -122,7 +122,7 @@ class JSONSchemaPropertyDescriptionSanitizationTestCase(TestCase):
field = prop.to_form_field('vendor_code')
self.assertInHTML(
self.assertHTMLEqual(
'<div class="rendered-markdown"><p><b>Vendor</b> code</p></div>',
field.help_text,
)
@ -140,7 +140,7 @@ class JSONSchemaPropertyDescriptionSanitizationTestCase(TestCase):
field = prop.to_form_field('capacity')
self.assertInHTML(
self.assertHTMLEqual(
'<div class="rendered-markdown"><p>Gross disk size in <code>GB</code></p></div>',
field.help_text,
)
@ -154,7 +154,7 @@ class JSONSchemaPropertyDescriptionSanitizationTestCase(TestCase):
field = prop.to_form_field('capacity')
self.assertInHTML(
self.assertHTMLEqual(
'<div class="rendered-markdown">'
'<p>Gross disk size in <strong>GB</strong></p></div>',
field.help_text,
@ -169,7 +169,7 @@ class JSONSchemaPropertyDescriptionSanitizationTestCase(TestCase):
field = prop.to_form_field('capacity')
self.assertInHTML(
self.assertHTMLEqual(
'<div class="rendered-markdown"><p>Gross disk size in gigabytes</p></div>',
field.help_text,
)