mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
eb828b364d
create_storage_ceph and create_storage_netfs wrote the pool, host, user, secret and format values into the pool XML unescaped and unchecked: the page's patterns were the only guard, and a direct POST could break or extend the XML. The values now go through util.xml_escape, as the network code does. The page's host fields stopped at 20 characters, so nfs01.storage.example.com could not be typed: they take a host name's 253; the Ceph pool and user fields lose the limit the server never had.
30 lines
1.5 KiB
Python
30 lines
1.5 KiB
Python
"""The host, pool, user and format values of a new Ceph or NFS pool go into
|
|
its XML as text, whatever characters they hold."""
|
|
|
|
from unittest.mock import patch
|
|
|
|
from django.test import SimpleTestCase
|
|
from lxml import etree
|
|
from vrtManager.storage import wvmStorages
|
|
|
|
ODD = "a'b\"c<d>&e"
|
|
|
|
|
|
class PoolXmlTests(SimpleTestCase):
|
|
def defined_xml(self, create, *args):
|
|
with patch("vrtManager.connection.connection_manager.get_connection") as get:
|
|
getattr(wvmStorages("host", "login", "pw", 1), create)(*args)
|
|
return etree.fromstring(get.return_value.storagePoolDefineXML.call_args.args[0])
|
|
|
|
def test_ceph_values_are_text(self):
|
|
pool = self.defined_xml("create_storage_ceph", "rbd", "pool1", ODD + "pool", ODD + "host", ODD + "user", ODD + "secret")
|
|
self.assertEqual(pool.findtext("source/name"), ODD + "pool")
|
|
self.assertEqual(pool.find("source/host").get("name"), ODD + "host")
|
|
self.assertEqual(pool.find("source/auth").get("username"), ODD + "user")
|
|
self.assertEqual(pool.find("source/auth/secret").get("uuid"), ODD + "secret")
|
|
|
|
def test_nfs_values_are_text(self):
|
|
pool = self.defined_xml("create_storage_netfs", "netfs", "pool1", ODD + "host", "/srv/nfs", ODD + "fmt", "/mnt/pool1")
|
|
self.assertEqual(pool.find("source/host").get("name"), ODD + "host")
|
|
self.assertEqual(pool.find("source/format").get("type"), ODD + "fmt")
|
|
self.assertEqual(pool.find("source/dir").get("path"), "/srv/nfs")
|