mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
d816d8d09f
The settings page took the posted theme name as it came and wrote it into the @import lines of wvc-main.scss and the compiled CSS: a name with "../" or a quote imported files outside the themes directory (CodeQL py/path-injection; the page is for superusers). The name must now be one of the directories in SASS_DIR/wvc-themes, the list the page already offers; anything else is refused with a message and nothing is written. themes_list is empty when SASS_DIR has no themes, so every name is refused then. Checked with the real dev/scss: flatly is applied and compiled as before, "../../etc" is refused and leaves the CSS alone. The test fails on the previous code.
27 lines
1.2 KiB
Python
27 lines
1.2 KiB
Python
"""The theme name posted on the settings page must be one of the themes in
|
|
SASS_DIR/wvc-themes: it is written into @import paths and the compiled CSS."""
|
|
|
|
import os
|
|
import tempfile
|
|
|
|
from appsettings.models import AppSettings
|
|
from django.contrib.auth.models import User
|
|
from django.test import TestCase
|
|
from django.urls import reverse
|
|
|
|
|
|
class ThemeNameTests(TestCase):
|
|
def setUp(self):
|
|
self.client.force_login(User.objects.create_superuser("th-admin", "th@example.com", "pw"))
|
|
self.sass = tempfile.TemporaryDirectory()
|
|
self.addCleanup(self.sass.cleanup)
|
|
os.makedirs(os.path.join(self.sass.name, "wvc-themes", "flatly"))
|
|
AppSettings.objects.filter(key="SASS_DIR").update(value=self.sass.name)
|
|
self.before = AppSettings.objects.get(key="BOOTSTRAP_THEME").value
|
|
|
|
def test_a_name_that_is_not_a_theme_is_refused(self):
|
|
for theme in ("../../etc", "flatly';@import '/etc/passwd", "nope", ""):
|
|
with self.subTest(theme=theme):
|
|
self.client.post(reverse("appsettings"), {"BOOTSTRAP_THEME": theme})
|
|
self.assertFalse(os.path.exists(os.path.join(self.sass.name, "wvc-main.scss")))
|
|
self.assertEqual(AppSettings.objects.get(key="BOOTSTRAP_THEME").value, self.before)
|