From 35fea424eeb583ff0dee57e41026285d68e6f1d8 Mon Sep 17 00:00:00 2001
From: catborise <catborise@gmail.com>
Date: Sat, 10 Oct 2026 20:55:38 +0300
Subject: [PATCH] test: read the page scripts with lxml, not a tag regex

CodeQL flags the <script> regex (py/bad-tag-filter); the HTML parser finds the inline scripts as the new-VM dialog test does.
---
 computes/test_cpu_graph.py     | 4 ++--
 instances/test_stats_sample.py | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/computes/test_cpu_graph.py b/computes/test_cpu_graph.py
index 07f4ce60..6d94d434 100644
--- a/computes/test_cpu_graph.py
+++ b/computes/test_cpu_graph.py
@@ -3,7 +3,6 @@ previous answer and now, without waiting, when that sample is recent and
 unaltered; otherwise over one second as before."""
 
 import json
-import re
 import shutil
 import subprocess
 import unittest
@@ -15,6 +14,7 @@ from django.core import signing
 from django.test import TestCase
 from django.urls import reverse
 from libvirt import libvirtError
+from lxml import html
 
 from computes.models import Compute
 from computes.views import CPU_SAMPLE_MAX_AGE, CPU_SAMPLE_SIGNER
@@ -127,7 +127,7 @@ class GraphScriptTestCase(TestCase):
             details.return_value.get_node_info.return_value = ("h", "x86_64", 1024, 2, "cpu", "qemu+tcp://h/system")
             details.return_value.get_memory_usage.return_value = {"total": 1024, "usage": 512, "percent": 50}
             page = self.client.get(reverse("overview", args=[compute.id])).content.decode()
-        script = next(s for s in re.findall(r"<script>(.*?)</script>", page, re.S) if "pollWhileVisible(" in s)
+        script = next(s for s in html.fromstring(page).xpath("//script[not(@src)]/text()") if "pollWhileVisible(" in s)
         js = """
         const vm = require("vm");
         const charts = [], requests = [];
diff --git a/instances/test_stats_sample.py b/instances/test_stats_sample.py
index 98525870..ca83764a 100644
--- a/instances/test_stats_sample.py
+++ b/instances/test_stats_sample.py
@@ -3,7 +3,6 @@ its compute; the next poll sends it back so that the rates are averages since
 then, without waiting."""
 
 import json
-import re
 import shutil
 import subprocess
 import unittest
@@ -15,6 +14,7 @@ from django.contrib.auth import get_user_model
 from django.core import signing
 from django.test import TestCase
 from django.urls import reverse
+from lxml import html
 from instances.models import Instance
 from vrtManager.instance import USAGE_MAX_WINDOW
 
@@ -140,7 +140,7 @@ class StatsScriptTestCase(TestDriverVM, TestCase):
         return response.content.decode()
 
     def test_the_next_poll_sends_the_previous_sample(self):
-        script = next(s for s in re.findall(r"<script>(.*?)</script>", self.page(), re.S) if "statsSample" in s)
+        script = next(s for s in html.fromstring(self.page()).xpath("//script[not(@src)]/text()") if "statsSample" in s)
         js = """
         const vm = require("vm");
         const charts = [], requests = [], handlers = {};