j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 11:16:47 +00:00
Code Issues Projects Releases Wiki Activity

fix: serve compute JSON endpoints as application/json, build chipset list safely

Browse source 
compute_graph (text/javascript) and the machine type, disk bus, video
model and domain capability views (text/html) return JSON; send it as
application/json. create_instance_w1.html builds the chipset <option>
elements with .val().text() instead of string concatenation.
This commit is contained in:
catborise 2026-10-02 22:34:05 +03:00
parent d250915e17
commit e76149c71a
3 changed files with 26 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

13
computes/views.py
View file

@ -141,10 +141,7 @@ def compute_graph(request, compute_id):
comp_mgr = ComputeManager(compute_id)
data = comp_mgr.compute_graph()
response = HttpResponse()
response["Content-Type"] = "text/javascript"
response.write(data)
return response
return HttpResponse(data, content_type="application/json")
def get_compute_disk_buses(request, compute_id, arch, machine, disk):
@ -157,7 +154,7 @@ def get_compute_disk_buses(request, compute_id, arch, machine, disk):
:return:
"""
comp_mgr = ComputeManager(compute_id)
return HttpResponse(comp_mgr.get_disk_buses(arch, machine, disk))
return HttpResponse(comp_mgr.get_disk_buses(arch, machine, disk), content_type="application/json")
def get_compute_machine_types(request, compute_id, arch):
@ -168,7 +165,7 @@ def get_compute_machine_types(request, compute_id, arch):
:return:
"""
comp_mgr = ComputeManager(compute_id)
return HttpResponse(comp_mgr.get_machine_types(arch))
return HttpResponse(comp_mgr.get_machine_types(arch), content_type="application/json")
def get_compute_video_models(request, compute_id, arch, machine):
@ -180,7 +177,7 @@ def get_compute_video_models(request, compute_id, arch, machine):
:return:
"""
comp_mgr = ComputeManager(compute_id)
return HttpResponse(comp_mgr.get_video_models(arch, machine))
return HttpResponse(comp_mgr.get_video_models(arch, machine), content_type="application/json")
def get_dom_capabilities(request, compute_id, arch, machine):
@ -192,7 +189,7 @@ def get_dom_capabilities(request, compute_id, arch, machine):
:return:
"""
comp_mgr = ComputeManager(compute_id)
return HttpResponse(comp_mgr.get_dom_capabilities(arch, machine))
return HttpResponse(comp_mgr.get_dom_capabilities(arch, machine), content_type="application/json")
class ComputeManager:

9
instances/templates/create_instance_w1.html
View file

@ -106,12 +106,9 @@
$("#select_chipset").find('option').remove();
$("#select_archs").val(arch);
$.each(data['machines'], function(i, item) {
if (item == '{{ default_machine }}') {
var selected = 'selected';
}else{
var selected = '';
}
$("#select_chipset").append('<option value="' + item + '"' + selected +'>' + item + '</option>');
$("#select_chipset").append(
$("<option>").val(item).text(item).prop("selected", item == '{{ default_machine }}')
);
});
});
}

18
instances/test_xss.py
View file

@ -81,6 +81,20 @@ class JsonEndpointContentTypeTestCase(TestCase):
self.client.get(reverse("ds_openstack_metadata", args=["latest"]))
)
def test_compute_json_endpoints_are_json(self):
urls = [
reverse("compute_graph", args=[self.compute.id]),
reverse("machines", args=[self.compute.id, "x86_64"]),
reverse("buses", args=[self.compute.id, "x86_64", "q35", "disk"]),
reverse("domcaps", args=[self.compute.id, "x86_64", "q35"]),
]
with patch("computes.views.ComputeManager") as mock_mgr:
for method in ("compute_graph", "get_machine_types", "get_disk_buses", "get_dom_capabilities"):
getattr(mock_mgr.return_value, method).return_value = "{}"
for url in urls:
with self.subTest(url=url):
self.assertJson(self.client.get(url))
def test_vm_logs_is_json(self):
self.assertJson(self.client.get(reverse("vm_logs", args=[self.instance.name])))
@ -106,6 +120,10 @@ class TemplateHtmlConcatenationTestCase(TestCase):
self.assertNotIn("'<option value=' + item", src)
self.assertNotIn('pool + "<span', src)
def test_create_wizard_chipset_list_does_not_concatenate_into_html(self):
src = self._read("instances/templates/create_instance_w1.html")
self.assertNotIn("""append('<option value="' + item""", src)
def test_create_wizard_volume_lists_do_not_concatenate_volume_names_into_html(self):
src = self._read("instances/templates/create_instance_w2.html")
self.assertNotIn("'<option value=' + item", src)