mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 11:46:49 +00:00
66151d42b1
create_secret wrote the usage value into the secret XML with an f-string,
unchecked: a quote, "<" or "&" broke the XML or added to it. The page's
pattern ([a-z0-9. ]+) was the only check and refused real values: a
volume secret's path ("/") and an iSCSI IQN ("-", ":"). The XML is now
built with lxml, so the value is text whatever it holds, and the input
keeps only required and the form's 100 characters; libvirt reports a
value it does not take.
A live test creates a volume, an iSCSI and a Ceph secret with real
values through the page.
28 lines
1.3 KiB
Python
28 lines
1.3 KiB
Python
"""A secret's usage value goes into its XML as text, whatever it holds: a
|
|
volume path, an iSCSI IQN or a Ceph name, and characters XML gives a meaning."""
|
|
|
|
from unittest.mock import patch
|
|
|
|
from django.test import SimpleTestCase
|
|
from lxml import etree
|
|
from vrtManager.virtsecrets import wvmSecrets
|
|
|
|
|
|
class CreateSecretTests(SimpleTestCase):
|
|
def defined_xml(self, usage_type, data):
|
|
with patch("vrtManager.connection.connection_manager.get_connection") as get:
|
|
wvmSecrets("host", "login", "pw", 1).create_secret("no", "yes", usage_type, data)
|
|
return etree.fromstring(get.return_value.secretDefineXML.call_args.args[0])
|
|
|
|
def test_the_usage_value_is_text_of_its_element(self):
|
|
for usage_type, element, data in (
|
|
("volume", "volume", "/var/lib/libvirt/images/vm-1.qcow2"),
|
|
("iscsi", "target", "iqn.2026-10.test.wvc:lun"),
|
|
("ceph", "name", "client.libvirt secret"),
|
|
("volume", "volume", "/a'b<c>&d\""),
|
|
):
|
|
with self.subTest(usage_type=usage_type, data=data):
|
|
secret = self.defined_xml(usage_type, data)
|
|
self.assertEqual((secret.get("ephemeral"), secret.get("private")), ("no", "yes"))
|
|
self.assertEqual(secret.find("usage").get("type"), usage_type)
|
|
self.assertEqual(secret.findtext(f"usage/{element}"), data)
|